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a  set  of  breakout  sessions. 
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1.  BARANZINI,  DANIELE;  MACCHI,  LUIGI;  DE  GRANDIS,  ELISA; 
CACCIABUE,  P.  C.:  CONCEPT  OF  DEVICE  VERSUS  ACTIVITY  IN 
DECISION  SUPPORT  SYSTEMS 

The  concept  of  intelligent  decision  support  systems  in  several  work  domains  (i.e., 
healthcare,  process  industry,  aircraft  maintenance,  human  spaceflight)  has  been 
frequently  operationalised  into  formal  devices.  These  are  narrow  but  robust  programs  or 
software  tools  containing  enhanced  computational  power,  providing  humans  with  solid 
heuristics/algorithms  in  order  to  reach  higher  and  better  decision  solutions. 

These  systems  are  envisaged  as  either  basic  support  tools  or  prostheses  of  human 
intelligence  depending  by  the  school  of  thought  (Feltovich  et  al.,  1997).  Therefore,  in 
this  view  the  formal  structure  contains  the  guidance  in  the  form  of  pieces  of  information 
and  knowledge  to  varying  degrees  of  freedom,  by  which  human  supervision  is  led  or 
accompanied  across  families  of  solutions.  These  systems  do  support,  in  the  sense  that 
they  broaden  the  band  of  valid  and  reliable  alternatives  to  joint  human-machine 
decisions. 

The  scenario  depicted  above  is  general  and  does  not  cover,  or  focus  on  any  specific 
application.  However,  it  follows  from  this  that  the  concepts  of  decision  and  support 
conveyed  a  particular  meaning  into  the  role  of  a  device  embedding  both  concepts  of 
decision  and  support. 

Notably  what  is  left  out  of  the  equation  is  the  idea  that  decisions  may  be  described  as 
practices  in  context.  Decisions  are  constantly  shaped  by  events,  situations  or  unexpected 
activities  often  not  contained  in  the  support  system  or  device. 

What  we  propose  in  this  case  is  to  extend  the  concept  of  support  externally  to  the  device 
assuming  that  the  intelligence  should  be  associated  to  the  process  or  activity  and  not  to 
the  device  itself. 

The  proposition  statement  will  be  discussed  in  the  light  of  three  different  case  studies 
encompassing  flight  operations,  aircraft  maintenance  and  automotive  environments.  A 
brief  introduction  of  the  three  cases  follows: 

•  Team  systems  in  aircraft  maintenance:  planning  and  scheduling  nightmares.  At 
any  point  in  time  within  an  hangar,  there  are  several  maintenance  check  plans  and 
schedules  with  different  speeds  and  progressions.  Multiple  concurrent  plans  and 
schedules  generate  multiple  paths  of  actions  and  decisions  affecting  dedicated 
operational  teams.  Reliable  and  flexible  decisions  support  systems  for  man/power 
allocation,  re-scheduling  of  operations,  reconfiguration  of  trades  and  grades  in  the 
teams  are  limited  in  their  predictive  capacity  and  support  on  how  to  block  key 
variances  in  the  operations.  New  support  systems  appear  to  be  rigid. 

•  Intelligent  Speed  Adaptation  (ISA).  ISA  is  a  system  by  which  the  vehicle  "knows" 
the  permitted  or  recommended  maximum  speed  for  the  road.  The  standard  system 
uses  an  in-vehicle  digital  road  map  onto  which  speed  limits  have  been  coded, 
combined  with  a  positioning  system  which  could  be  GPS.  This  system,  if  not 
incorporated  in  an  “intelligent”  framework,  is  not  able  to  take  into  consideration 
the  general  context,  both  the  environmental  and  social  one,  in  which  the  “driving” 
activities  takes  place. 
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•  Traffic  Alert  &  Collision  Avoidance  System  (TCAS)  and  Uberlingen  Accident. 
TCAS  scans  the  vicinity  by  interrogating  the  transponders  of  other  aircraft.  It  then 
uses  the  received  transponder  signals  to  compute  distance,  bearing  and  altitude 
relative  to  the  own  aircraft.  As  TCAS  checks  the  other  aircraft’s  relative  distance 
permanently  in  short  time  intervals,  it  can,  therefore,  also  calculate  the  other 
aircraft’s  closure  rate  relative  to  the  own  aircraft.  When  TCAS  detects  that  an 
aircraft’s  distance  and  closure  rate  becomes  critical,  TCAS  generates  aural  and 
visual  annunciations  for  the  pilots.  If  necessary,  it  also  computes  aural  and  visual 
pitch  commands  to  resolve  a  conflict.  The  in-flight  collision  happened  in  the  skies 
of  Uberlingen  (Germany)  in  July  2002  showed  that  integration  of  TCAS  into  the 
system  aviation  was  insufficient  and  did  not  correspond  in  all  points  with  the 
system  philosophy. 

Reference 

Feltovich,  P.  J.,  Ford  K.  M.  &  Hoffman,  R.  R.  (1997).  Expertise  in  context:  Human  and 
machine.  MIT  Press. 
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2.  BOLIA,  ROBERT:  INTELLIGENT  DECISION  SUPPORT  SYSTEMS  IN 
NETWORK-CENTRIC  MILITARY  OPERATIONS 

The  investment  by  the  United  States  Air  Force  in  intelligent  decision  support  systems 
(DSS)  is  being  driven  increasingly  by  the  requirements  of  Network-Centric  Warfare 
(NCW;  Cebrowski  &  Garstka,  1998;  Alberts,  Garstka,  &  Stein,  1999;  Alberts  &  Hayes, 
2003).  NCW  is  a  concept  of  operations  which  claims  that  the  dense  networking  of 
sensors  and  shooters  will  provide  commanders  with  an  unprecedented  level  of  situation 
awareness  (SA),  that  this  SA  will  be  shared  via  a  common  operational  picture  (COP), 
and  that  the  shared  SA  so  cultivated  will  increase  the  effective  speed  of  command  and 
enable  self-synchronization  of  forces.  The  prophets  of  this  dogma  allege  that  it  offers 
no  less  than  a  revolution  in  military  affairs.  Indeed,  they  have  proposed  that  the  NCW 
thesis  -  specifically,  the  magnitude  and  ubiquity  of  information  guaranteed  by  the  COP 
-  implies  a  transformation  of  the  traditional  hierarchical  chain  of  command  such  that 
decisions  previously  made  at  the  top  of  the  pyramid  will  be  pushed  down  to  lower  levels, 
a  concept  known  as  power  to  the  edge  (Alberts  &  Hayes,  2003). 

Needless  to  say,  there  have  been  challenges  to  this  position  almost  from  its  inception 
(Barnett,  1999),  which  have  not  yet  abated  (Kaufman,  2005).  NCW  has  been  attacked 
for  its  shaky  foundations  (Griffin  &  Reid,  2003;  Bolia,  Nelson,  &  Vidulich,  in  press),  its 
dubious  logic  (Barnett,  1999),  its  inadmission  of  countermeasures  (Bolia,  2004),  and  its 
technological  fragility  (Talbot,  2004),  in  addition  to  the  fact  that  it  appears  to  be  driven 
by  the  commercial  availability  of  technology  rather  than  operationally  derived  military 
requirements  (Kaufman,  2005).  To  researchers  in  the  Air  Force  Research  Laboratory’s 
Human  Effectiveness  Directorate,  however,  the  most  interesting  questions  with  respect 
to  NCW  revolve  around  the  possible  unintended  consequences  for  the  human  operator, 
all  of  which  have  bearing  on  human  interaction  with  intelligent  DSSs  (Bolia,  Vidulich, 

&  Nelson,  2005). 

Perhaps  the  most  immediately  obvious  issue  is  that  of  information,  for  NCW  will 
ostensibly  provide  operators  at  all  levels  of  the  command  chain  with  an  amount  of 
information  unparalleled  in  the  history  of  warfare.  Yet  this  is  only  an  advantage  under 
the  assumption  that  more  information  is  always  better,  when  in  fact  there  are 
innumerable  cases  in  which  this  assumption  does  not  hold.  There  are,  for  example, 
issues  of  data  quality,  data  relevance,  and  data  interpretation,  as  well  as  the  illusion  of 
completeness  -  the  idea  that  one  doesn’t  know  what  one  doesn’t  know  (Bolia,  Vidulich, 
Nelson,  &  Cook,  2003).  But  even  if  the  data  are  verifiably  good  data,  information 
overload  may  still  be  an  issue.  The  idea  that  a  system  can  handle  more  information 
because  of  an  increase  in  network  capacity  or  bandwidth  does  not  mean  that  the 
operator  using  the  system  can  do  the  same.  It  is  here  that  the  requirement  for  decision 
support  is  levied  upon  the  system. 

But  there  are  problems  with  intelligent  decision  support  for  military  commanders,  not 
the  least  of  which  is  the  fundamental  complexity  and  uncertainty  of  war  itself 
(Clausewitz,  2002).  Classic  DSSs  -  rule-based  or  knowledge-based  systems  -  employ  a 
flowchart  or  filter  model,  in  which  a  decision  or  course  of  action  is  determined  by  the 
set  of  truths  satisfied  by  the  data  (Russell  &  Norvig,  1995).  The  benefit  of  these 
systems  is  that  they  are  closed,  and  as  such  the  context  of  the  problem  is  encoded 
implicitly  in  the  data  provided.  Unfortunately,  they  work  well  only  for  problems  that 
are  either  relatively  small  in  scope,  such  as  troubleshooting  a  piece  of  hardware,  or 
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relatively  well-understood  and  well-described  by  subject-matter  experts,  such  as 
medical  diagnosis.  In  larger  or  more  complex  domains,  analogous  systems  may  be 
constructed  using  nonlinear  pattern  recognition  techniques  such  as  neural  networks. 

There  are  at  least  two  problems  with  the  use  of  such  systems  in  the  realm  of  combat. 
First,  there  is  the  problem  of  representation.  This  is  engendered  in  part  by  the 
complexity  of  the  problem,  in  part  by  its  multidimensionality,  and  in  part  by  the  failure 
of  scientists  to  make  more  than  a  minor  dent  in  the  twin  problems  of  context  encoding 
and  semantic  comprehension  (Bolia,  Nelson,  Vidulich,  &  Taylor,  2004).  It  is  easy 
enough  to  encode  the  positions  of  friendly  and  enemy  units,  along  with  information 
about  their  combat  effectiveness,  the  terrain  in  which  they  are  located,  and  even  the 
weather.  But  is  this  enough  context?  What  about  activity  on  other  fronts  that  may 
affect  the  battle?  What  about  dynamic  rules  of  engagement?  It  is  not  immediately  clear 
how  these  critical  factors  integrate  with  the  varieties  of  information  commonly  encoded 
in  a  spatio-temporal  grid.  Moreover,  the  DSS  will  not  have  the  long-term  context  that 
an  individual  commander  might  build  up  over  the  course  of  a  campaign.  Finally,  even 
if  the  problem  of  context  representation  is  solved,  the  problem  of  interpretation  of  the 
context  remains. 

The  idea  that  the  COP  will  not  eliminate  hermeneutical  discrepancies  has  been  raised 
before  (Bolia,  Vidulich,  &  Nelson,  2005),  and  is  tied  to  the  second  problem:  the 
difficulty  of  predicting  adversarial  decisions.  In  nearly  every  battle,  the  success  or 
failure  of  a  commander’s  action  depends  heavily  on  the  action  of  the  enemy  commander. 
This  poses  several  problems:  1)  how  to  represent  the  adversary’s  perception  and 
comprehension  of  the  situation;  2)  how  to  represent  the  adversary’s  strategic  vision;  and 
3)  how  these  might  interact  to  form  the  interpretation  that  will  lead  to  a  decision. 

It  might  be  insinuated  that  doctrine  is  the  answer,  and  so  superficially  would  it  appear  to 
be.  But  doctrine  leaves  plenty  of  room  for  contradiction.  For  example,  conventional 
military  doctrine  suggests  that  a  commander  not  divide  his  forces  in  the  face  of  an 
enemy.  Yet  the  same  doctrine  also  points  to  surprise  as  one  of  the  fundamental 
principles  of  war  (Sun  Tzu,  1963).  What  happens  when  a  commander  divides  his  force 
simply  because  he  knows  that  the  enemy,  relying  on  the  doctrine  commonly  accepted 
by  both  sides,  believes  that  he  would  never  do  so  (Bolia,  Nelson,  Vidulich,  &  Taylor, 
2004)?  Now  he  has  the  element  of  surprise,  which,  depending  on  the  context,  may  be 
more  important  than  mass. 

This  begins  to  hint  at  another  question,  which  is  more  epistemological  in  nature.  If  a 
DSS  is  to  provide  information,  how  is  it  to  know  what  is  the  right  information;  if  it  is  to 
provide  a  course  of  action,  in  other  words  offer  a  decision,  how  is  it  to  know  what  is  the 
right  decision.  More  generally,  given  a  desired  outcome,  does  a  correct  decision  exist? 
More  generally  still,  given  a  collection  of  decisions,  is  it  possible  under  every 
circumstance  to  assign  values  to  these  decisions  such  that  they  can  be  ordered  according 
to  decision  quality?  Is  it  possible  to  do  this  in  any  except  the  most  trivial 
circumstances? 

It  is  here  that  the  importance  of  the  adversary’s  decision  becomes  clear.  It  is  easy  to 
conceive  of  a  situation  in  a  two-person  game  in  which  a  player  arrives  at  the  brink  of 
victory  only  to  be  parried  by  a  decisive  move  by  his  opponent.  It  should  also  be 
apparent  to  any  student  of  military  history  that  battles  are  at  least  as  often  lost  as  won; 
that  is  to  say,  it  may  be  easier  to  identify  the  losing  move  of  the  vanquished  than  the 
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winning  move  of  the  victor  (Bolia,  2005).  This  is  a  problem  in  real-time,  of  course,  for 
reasons  already  identified.  But  as  Simon  (1974)  has  pointed  out,  even  in  games  of 
perfect  information,  in  which  the  only  variable  is  the  adversary’s  decision,  it  is  often 
impossible  to  resolve,  even  ex  post  facto,  which  was  the  losing  move.  Somewhat 
incongruously,  this  has  been  less  of  an  issue  in  military  history,  although  why  a 
particular  “losing  move”  was  selected  has  been  the  topic  of  much  speculation.  For 
example,  142  years  after  the  fact,  the  debate  rages  on  about  why  Lee  chose  to  attack  the 
Union  center  on  the  third  day  of  the  Battle  of  Gettysburg,  despite  the  fact  that  a  frontal 
assault  against  prepared  defenses  not  only  went  against  prevailing  doctrine  but  against 
Lee’s  experience  as  the  defending  commander  at  Fredericksburg. 

Of  course,  the  idea  may  be  introduced  that  commanders  in  battle  do  not  make  rational 
decisions  in  the  sense  of  enumerating  courses  of  action  and  choosing  the  best  among 
them,  but  rather  make  recognition-primed  decisions  according  to  the  model  of  expert 
decision  making  put  forth  by  Klein  (1997,  1998),  in  which  decision  quality  is  secondary 
to  decision  speed.  But  this  is  not  helpful  in  the  construction  of  real-time  DSSs,  since  in 
Klein’s  model  the  recognition  triggers  not  only  apprehension  but  also  comprehension  of 
the  situation,  which  the  DSS  does  not  have.  Moreover,  it  has  been  pointed  out  that 
recognition-primed  decisions  may  in  fact  be  compromised  by  the  introduction  of 
intelligent  decision  support,  since  the  interaction  with  the  DSS  may  require  more  time 
than  it  might  have  taken  the  commander  to  make  a  recognition  primed  decision  (Bolia, 
Nelson,  Vidulich,  &  Taylor,  2004). 

In  addition  to  the  problems  associated  with  measurement  of  decision  quality,  the 
commander’s  interaction  with  the  DSS  must  be  considered.  Parasuraman  and  his 
colleagues,  among  others,  have  pointed  out  a  number  of  unintended  consequences  of 
human  interaction  with  highly  automated  systems  (Parasuraman  &  Riley,  1999).  For 
example,  if  a  commander  does  not  have  confidence  in  the  DSS,  he  may  spend  an 
inordinate  amount  of  time  “drilling  down”  to  inspect  the  sources  of  the  information 
provided,  rendering  it  useless  in  a  time-sensitive  environment,  or  he  may  elect  not  to 
use  it  at  all.  On  the  other  hand,  overconfidence  in  the  DSS  -  an  example  of  a 
phenomenon  associated  with  highly  reliable  automated  systems  that  has  been  termed 
“automation  complacency”  -  may  lead  to  a  commander’s  acceptance  of  a  course  of 
action  even  though  it  is  inappropriate.  Also,  increasing  reliance  by  commanders  on  the 
DSS  may  engender  degradation  in  their  unaided  decision  making  skills,  which  will  still 
be  needed  if  connections  to  the  network  are  lost  or  in  case  of  electrical  power  failure. 

Finally,  there  are  ethical  issues  linked  to  the  use  of  automated  decision  support.  The 
individual  commander  is  ultimately  responsible  for  the  decisions  he  makes,  but  will  he 
be  held  accountable  by  a  court  martial  if  he  was  following  the  flawed  advice  of  an 
otherwise  reliable  DSS?  One  of  the  tenets  of  NCW  is  that  increased  information 
availability  and  intelligent  decision  support  will  allow  decisions  formerly  made  by 
lieutenant  colonels  to  be  made  by  lieutenants.  What  the  former  presumably  have  that 
the  latter  almost  certainly  lack  is  an  expertise  based  on  experience  that  may  help  them  to 
better  evaluate  the  course  of  action  proposed  by  the  DSS  and  avoid  some  of  the 
aforementioned  automation  failures. 
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3.  CORKER,  KEVIN:  EXPERIENCE  &  REQUIREMENT:  COGNITIVE 
ORIENTATION  IN  DEVELOPMENT  OF  DECISION  SUPPORT  TOOLS 
ADVANCED  AEROSPACE  OPERATIONS 

Decisions  with  respect  the  operation  of  international  air  transportation  services  are  taken 
on  scales  from  seconds  to  months,  impacting  behavior  from  meters  to  miles  and  are 
made  by  automation,  individual  human  operators,  corporations,  and  regulatory 
government  agencies.  All  of  these  decisions  interact  in  the  real  time  theatre  of 
operations,  and  all  are  supported  by  one,  or  many,  decision  support  systems.  In  the 
design,  definition,  deployment,  adaptation  and  adoption  of  these  systems,  patterns  of 
behavior  for  human-system  integration  are  observed.  The  patterns  either  amplify  or 
diminish  the  impact  of  the  decision  aiding  and  the  consequent  overall  joint  cognitive 
system  effectiveness.  The  goal  of  this  discussion  is  to  sketch  the  consistent  outline  of 
these  patterns  from  experience  in  the  aerospace  domain  in  order  to  provide  predictive 
support,  not  only  for  the  final  adapted  use  of  the  systems,  but  also  to  plot  the  transition 
trajectory  of  inserting  decision  support  tools  at  various  levels  and  in  varied  epochs  of 
the  aviation  systems  evolution. 

3.1  Decision  Aiding  Dimensions: 

Decision  support  is  provided  in  all  cases  in  which  it  is  assumed  that  either  by  the  pace, 
scale  or  the  complexity  of  operations  the  human  cannot  make  “optimal,  accurate  or 
timely  responses”.  As  it  was  expressed  a  recent  international  symposium  on  aviation 
(USA/Europe  ATM  Symposium,  2005),  “when  there  is  a  difference  between  available 
and  achieved  performance,  then  decision  support  tools  are  brought  to  bear.”  These  gaps 
between  optimal  and  actual  are  expressed  with  respect  to: 

•  Safety:  The  difference  between  no  accident/incidents  in  system  and  the  loss  of  life, 
property  and  operating  margin  that  is  observed 

•  Efficiency:  The  gap  between  demand  at  a  time  and  capacity  at  that  time  to 
accommodate  all  users 

•  Adaptability:  The  tension  between  prediction  and  flexible  response  at  every  level 
of  operation  from  flight  deck  response  to  airspace  configuration. 

•  Schedule:  The  mismatch  between  what  the  advertised  operations  and  the  actual 
operation  provide  in  route  and  time  of  service 

•  Reliability:  The  difference  between  just-in-time  maintenance  and  system  degraded 
operation 

•  Cost:  The  shrinking  margin  between  revenue  and  costs  in  passenger-seat  miles. 

In  all  cases  in  which  there  is  a  perceived  gap,  decision  support  of  various  configuration 
is  deployed.  There  is  a  universal  assessment  that  “decisions”  need  to  be  aided.  However, 
there  is  a  much  less  clear  consensus  about  what  constitutes  a  decision  and  who  has  the 
responsibility  for  its  “making”.  And  there  is  reluctance,  in  this  provision  of  public 
service,  to  remove  the  human  practitioner  from  final  responsibility  for  performance. 
There  is,  therefore,  an  assumption  that  some  human  practitioner  (at  some  level  in  the 
action  cycle)  will  identify  failure  (i.e.  determine  that  the  parameters  of  operation  have 
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been  exceeded),  correct,  or  adjust  the  decision  aiding  system  under  anomalous 
operations. 

3.2  Determinants  of  Decision  Aiding  Adoption: 

The  aforementioned  assumption  of  human  responsibility  (and  consequent  dilemma  of 
intervention  and  reversion)  in  the  joint  cognitive  system  is  one  driver  in  the  trajectories 
of  adaptation  observed  with  decision  aiding  systems.  There  are  at  least  two  others  of 
primary  significance  in  adoption. 

The  decision-making  processes  in  this  system  are  widely  distributed  in  space  and  time. 
The  human  operators  (designers,  pilots,  air  traffic  controllers,  and  airline  operations 
personnel,  corporate  entities  and  governments)  must  monitor  and  predict  any  change  in 
the  distribution  of  authority  or  control  that  might  result  as  a  function  of  the  airspace 
configuration,  aircraft  state  or  equipage,  and  other  operational  constraints.  The  operators 
are  making  decisions  and  sharing  information  not  only  about  the  management  of  the 
airspace,  but  also  about  the  operating  state  of  that  airspace,  and  about  the  operating 
behaviors  of  the  automation  that  is  in  place  to  aid  them.  In  so  doing,  they  are  moving 
from  direct  participatory  to  supervisory  roles  and  from  supervisory  roles  to  automated 
system  monitoring  and  control  by  exception. 

The  notion  of  anomaly  (what  constitutes  an  exception)  in  the  interrelated  but 
independent  spheres  of  operation  is  fundamentally  ambiguous.  What  is  an  anomaly  in  a 
system  of  distributed  discretion,  where  pilot  action  (though  perhaps  different  from  a 
controller’s  intention  or  preference)  is  allowed  under  relaxed  self-separation  operations? 
Or  to  take  another  view,  what  is  an  actionable  alert  where  layers  of  automated 
information  system  provide  (to  all  participants)  levels  of  alert  and  warning  for  potential 
future  anomalies,  or  conflicts  that  are  subject  to  change  through  any  of  several  agents’ 
actions? 

3.3  Trajectories  of  Decision  Aiding  Adoption: 

These  are  arenas  where  knowledge  about  cognitive  bottlenecks,  human-system 
interaction,  and  system  dynamics  and  stability  is  critical.  Based  on  experiment, 
modeling,  observation  and  design,  we  suggest  that  there  are  several  commonly 
identifiable  patterns  of  concern  arising  from  decision  aiding: 

•  Shared  Values  becomes  a  dominant  issue  in  the  development  of  aiding  systems. 
Operation  must  converge  on  similar  valuation  processes,  and  these  processes  must 
be  kept  consistent  as  the  field  of  operation  changes.  This  requirement  holds  from 
conflict  alert  to  schedule  determination. 

•  Switching  mechanisms  among  tasks  at  hand  and  tasks  of  advisory  assessment 
become  critical  design  elements. 

•  Team  composition  impacts  of  decision  aiding  are  potentially  destabilizing. 

•  Individual  tailoring  of  decision  advisory  is  little  understood  in  its  impact  on 
effectiveness  and  on  team  operation 
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•  Maintenance  of  paths  of  least  constraint  for  human  operation  under  decision 
aiding  demands  for  immediate  optimization  are  leading  operators  to  “get  out 
ahead”  of  the  aiding  system  thereby  defeating  its  intended  benefits. 

•  Risk  equivalence  operations  are  being  observed  as  controllers  and  pilots  test  the 
limits  of  their  joint  operation  with  decision  aiding 

•  Methods  of  information  integration  and  segregation  are  being  observed  as  the 
decision  aid’s  integration  or  segregation  is  found  inadequate  to  other  tasks  of 
information  management  not  anticipated  by  designers. 

Finally,  I  would  like  to  suggest  that,  as  a  socio-technical  problem,  several  critical 
influences  can  be  identified  that  determine  the  rate  of  deployment  and  adaptation  to 
decision  aiding: 

1 .  Safety  Critical  Decision  Aiding  systems  have  been  influenced  in  their  deployment 
by  grants  of  “limited  immunity”  to  operators  who  will  agree  to  their  use. 

2.  Economically  Critical  Decision  Aiding  systems  have  been  accelerated  in  their 
deployment  through  “incentives”  to  users  who  agree  to  use  the  “optimal” 
information  provided. 

3.  Sociotechnical  Incentives  in  Decision  Aiding  systems  are  being  implemented  in 
response  to  workforce  changes  and  synchronized  mandatory  retirement  of  the  air 
traffic  and  pilot  workforce. 

4.  Technico-Organization  Incentives  are  being  brought  to  bear  on  Decision  Aiding 
system  deployment  as  infrastructure  support  for  current  operations  are 
decommissioned  and  organizations  are  reconfigured  to  match  new  command  and 
control  capabilities. 

The  impact  of  these  drivers  and  their  interaction  with  the  issues  of  adaptation  could  be 
used  to  support  prediction  of  both  the  success  and  potential  for  failure  of  current 
practice  in  decision  aiding. 
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4.  FARRINGTON-DARBY,  TRUDI  (WITH  WILSON,  JOHN):  EXPERTISE 
AS  A  SOCIALLY  BASED  CONSTRUCT 

Knowledge  acquisition  is  often  seen  as  the  cornerstone  of  the  development  of  expert 
systems.  These  systems  promise  to  act  instead  of,  or  support  the  overloaded,  unreliable 
and  limited  human  being  using  what  is  considered  to  be  the  most  efficient  and  optimal 
performance.  This  we  know  has  not  been  the  case  with  many  reasons  suggested  for  the 
shortcomings  of  this  claim. 

UK  railway  network  controllers  are  a  group  of  operators  who  control  a  mechanically 
and  electronically  operating  system  through  other  people.  This  paper  uses  railway 
controllers’  work  as  a  case  of  humans  working  in  a  sociotechnical  system  from  which  to 
explore  a  notion  of  expertise  as  a  social  construct.  Whereas  there  has  been  much  interest 
in  technical  skills  and  knowledge  to  perform  work  the  social  skills  and  knowledge  of 
the  social  system  has  perhaps  been  given  less  attention. 

Through  the  study  of  railway  controllers  we  were  able  to  identify  key  steps  of  their 
work  and  where  the  challenges  arise.  These  challenges  were  partly  cognitive  but  were 
also  related  to  the  controller’s  knowledge  of  the  people  with  which  they  worked. 

Several  themes  underlying  the  concept  of  “social  expertise”  were  identified  such  as 
social  skills,  knowledge  of  social  systems,  trust  in  information  sources  when  they  are 
human  and  non-technological,  knowledge  of  information  networks  and  how  they  can  be 
accessed. 

As  part  of  this  longer  naturalistic  study  of  the  work  of  controllers,  findings  investigating 
the  nature  of  expertise  within  their  work  has  prompted  a  specific  look  at  the 
implications  for  firstly,  the  methods  that  attempt  to  capture  and  represent  expertise  if  the 
concept  of  “social  expertise”  is  acknowledged  as  part  of  expertise,  and  secondly  how  we 
go  about  the  support  and  development  of  “social  expertise”  through  system 
development,  training  and  job  design. 
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5.  FUJITA,  YUSHI:  EMPATHETIC  ROBOTS:  A  METHOD  FOR 
ENHANCING  HUMAN  ABILITIES? 

A  girl  is  staring  into  an  animal  robot  with  affectionate  eyes  and  utters  with  heartful 
voices  “What  a  cute  thing  you  are!”  A  toymaker  made  a  runaway  success,  a  baby  doll 
which  speaks  in  response  to  human  voices  “Take  me  for  a  walk.”  It  is  said  that  there  are 
over  one  thousand  expressions  the  doll  can  make.  This  doll  hit  an  all-time  high  to 
middle  aged  Japanese  folks,  especially  those  who  are  in  their  fifties.  An  English 
teaching  tool  called  “Wizzy”  talks  back  in  response  to  questions  given  by  learners.  It 
says  “Try  again”  otherwise  the  learner  gives  a  correct  pronunciation.  It  is  getting 
popularity  among  Japanese  English  learners  because  they  say  they  do  not  feel 
embarrassed,  which  they  often  times  do  with  “real”  human  teachers.  These  examples, 
among  many  others,  suggest  that  empathetic  feelings  emerge  between  humans  and 
robots  of  some  types,  and  that  this  empathy  for  artifacts  is  broadening  human  minds  and 
even  enhancing  human  abilities.  Perhaps  the  artifacts  are  a  mirror  of  humans  who  face 
them,  and  the  humans  can  see  themselves,  through  interactions  with  the  artifacts,  more 
objectively.  Given  that  maximizing  human  abilities  is  the  role  of  intelligent  decision 
support  systems,  the  empathetic  approach  mentioned  above  may  be  worthwhile 
discussing.  In  addition,  this  line  of  discussion  will  lead  us  to  discuss  a  concern  that  these 
robots,  regardless  of  physical  appearances  they  possess,  may  actually  shape  our 
mentality. 
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6.  GROTE,  GUDELA:  HUMAN  CONTROL  OF  TECHNICAL  SYSTEMS  -  A 
MISLEADING  PRESUMPTION 

Abstract 

Regardless  of  a  system's  degree  of  automation,  it  is  humans  who  are  responsible  for  its 
functioning.  The  requirement  of  human  controllability  of  technical  systems  is  derived 
from  this  responsibility.  Human  factors  based  methods  for  the  design  of  human- 
machine  systems  are  meant  to  support  engineers  in  designing  systems  that  are 
controllable  by  the  human  operator  under  all  conditions.  KOMPASS  is  introduced  as  an 
example  of  these  methods.  In  view  of  human  fallibility  in  combination  with  loss  of 
control  over  technical  systems  as  ascertained  in  many  incident  and  accident  analyses,  it 
can  be  questioned  how  achievable  the  goal  of  human  control  over  technology  really  is. 
Reasons  for  lack  of  controllability  can  be  found  in  the  normative  assumptions  of  those 
developing  and  implementing  technology,  as  the  frequently  expressed  view  of  humans 
as  risk  factors  to  be  excluded  from  processes  via  technology  produces  technical  systems 
that  do  not  conform  to  human  capabilities.  With  the  increasing  complexity  of 
technology,  its  controllability  per  se  has  to  be  questioned  more  and  more.  In  this  paper 
therefore,  it  is  suggested  to  found  system  design  on  the  premise  of  (partial)  non¬ 
controllability  of  technology.  The  central  purpose  of  this  approach  is  to  help  human 
operators  to  better  deal  with  system  opaqueness  and  uncertainty  by  providing  them  with 
systematic  information  on  the  limits  of  control  over  the  technical  system  and  by  also 
relieving  them  of  some  of  their  responsibility.  System  designers  and  the  organizations 
using  these  systems  as  well  as  societal  institutions  have  to  take  on  responsibility  for  use 
of  technical  systems  whose  complexity  can  no  longer  be  mastered  entirely. 

6.1  Humans  assuming  responsibility  as  basic  requirement  for  the  functioning  of 
socio-technical  systems 

Every  automated  system  is  a  socio-technical  system,  independent  of  its  degree  of 
automation,  as  the  workerless  factory,  the  driverless  subway  or  automated  money 
transfer  systems  have  been  developed  by  humans  for  humans.  Therefore,  technical 
systems  should  never  be  looked  at  in  isolation,  but  always  as  part  of  a  socio-technical 
system,  which  includes  the  humans  operating  the  system  and  the  formal  and  informal 
structures  and  processes  within  which  they  work.  In  order  to  take  all  relationships 
relevant  for  the  socio-technical  system's  functioning  into  account,  it  is  also  necessary  to 
include  in  the  system  definition  all  those  organizations  and  organizational  units  which 
are  in  charge  of  system  design  and  maintenance  as  well  as  those  that  are  responsible  for 
rules  and  regulations  controlling  system  design  and  operation.  This  very  broad  system 
definition  is  particularly  useful  when  the  distribution  of  responsibility  has  to  be  decided. 
As  Timpe  (2001)  has  pointed  out,  increasingly  complex  and  distributed  socio-technical 
systems  further  the  diffusion  of  responsibility.  Using  driver  systems  as  an  example  he 
argues  that  automation  has  to  always  leave  people  in  control,  so  that  they  can  assume 
responsibility. 

Many  authors  agree  (e.g.  Boy,  1998;  Grote,  1999;  Hollnagel  &  Woods,  2005)  that  the 
limits  of  automation  are  not  only  determined  by  technological  capabilities  and  social 
acceptance,  but  even  more  so  by  the  necessity  to  keep  humans  in  control  so  that  they 
can  be  made  responsible  for  achieving  system  goals  and  all  associated  positive  and 
negative  consequences.  With  increasing  automation  of  even  very  complex  decision 
processeses  and  with  so-called  learning  systems,  these  limits  become  more  and  more 
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blurred.  In  a  very  broad  interdisciplinary  project  on  the  future  of  robotics,  it  was 
therefore  argued  that  the  learning  goal,  process  and  results  in  such  technical  systems 
have  to  be  made  transparent  for  the  human  user  to  allow  him  or  her  to  influence  and 
potentially  even  reverse  the  learning  (Christaller  et  al.,  2001).  Again  this  points  to  the 
importance  of  influence  on  and  control  over  technical  systems. 

Taking  human  responsibility  as  a  premise,  the  prerequisites  for  controllability  of 
technical  systems  are  discussed  in  the  next  section.  Subsequently,  it  is  shown  that  these 
prerequisites  are  frequently  unfulfilled  and  it  is  questioned  to  what  extent  they 
realistically  can  be  implemented.  In  the  final  section,  consequences  for  system  design 
are  presented. 

6.2  Prerequisites  for  human  control  over  technical  systems 

The  KOMPASS  (Complementary  analysis  and  design  of  production  tasks  in  socio- 
technical  systems)  method  (Grote  et  al.,  2000;  Wafler  et  al.,  2003)  is  presented  as 
representative  of  many  system  design  methods  whose  core  tenet  is  human  control  over 
technology  (e.g.  Hollnagel,  2003;  Timpe,  Jiirgensohn  &  Kolrep,  2002). 

KOMPASS  was  developed  to  support  an  integral  and  prospective  design  of  human- 
machine  systems  based  on  the  principle  of  complementarity  of  human  operator  and 
technology.  The  complementary  approach  explicitly  takes  into  account  that  humans  and 
technology  have  specific  strengths  and  weaknesses.  Differing  from  the  comparative 
approach  (cf.  Bailey,  1989),  these  strengths  and  weaknesses  are  not  used  for  competing 
assignments  of  tasks  to  either  human  or  technology,  but  for  a  consistent  design  of  the 
human- techno  logy  interaction,  thereby  producing  a  joint  system  of  a  new  quality.  In  the 
KOMPASS  method,  design  criteria  for  the  three  levels  of  analysis  of  human-machine 
interaction,  human  tasks,  and  work  system  were  defined  with  the  overall  objective  of 
supporting  the  socio-technical  system's  capability  of  controlling  variances  at  their 
source  (see  Fig.  1).  The  conceptual  basis  is  the  management  of  uncertainty  as  proposed 
by  Grote  (1997;  2004),  which  postulates  that  especially  with  a  high  level  of 
uncertainties  in  transformation  processes  and/or  the  system's  environment,  the  system 
has  to  be  rendered  capable  of  coping  with  uncertainties  by  strengthening  the  local 
actors' competence,  instead  of  trying  to  minimize  uncertainties  by  strict  centralization. 

At  the  level  of  human-machine  interaction,  KOMPASS  operationalizes  the  requirement 
of  human  control  over  the  technology  in  terms  of  the  three  elements  of  control,  i.e. 
transparency,  predictability,  and  means  of  influence.  Four  design  criteria  are  defined: 
process  transparency,  dynamic  coupling,  information  and  execution  authority,  and 
flexibility.  At  the  level  of  the  human  task,  the  main  objective  is  to  further  intrinsic 
motivation  through  task  orientation  by  means  of  design  of  humane  tasks  (e.g.  Ulich, 
1994).  At  the  level  of  the  work  system,  self-regulation  in  small  control  loops  is  aimed 
for  in  accordance  with  the  socio-technical  systems  approach,  encompassing  design 
criteria  such  as  task  completeness  and  independence,  polyvalence,  group  autonomy,  and 
supervisor's  boundary  regulation  (e.g.  Susman,  1976;  Pasmore,  1988). 
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Criteria  for  complementary  system  design 


HUMAN  TASK 

Motivation  through  task  orientation 


Task  completeness 

Planning  and  decision  making  requirement 
Task  variety 

Communication  requirements 
Organizational  transparency 
Control  over  working  conditions 
Opportunities  for  learning  and  development 
Temporal  flexibility 


Competence  for 
coping  with  variances 
at  their  source 


HUMAN-MACHINE  SYSTEM 


WORK  SYSTEM 


Controllability 
by  human  operator 

Process  transparency 
Dynamic  coupling 

Fit  of  decision  authority  and  responsibility 
Flexible  function  allocation 


Self-regulation  in 
small  control  loops 

Task  completeness 
Relative  independence 
Fit  of  regulation  needs  and  opportunities 
Polyvalence  of  operators 
Autonomy  of  production  groups 
Boundary  regulation  by  superiors 


Figure  1.  The  KOMPASS  design  approach 

Differing  from  other  methods  for  task  analysis  and  design,  KOMPASS  aims  at 
supporting  both  the  human  operators'  cognitive  readiness  to  perform  their  role  in  the 
human-machine  system  as  well  as  their  motivation  to  use  their  cognitive  capabilities  in 
line  with  the  system  goals.  An  example  of  this  is  the  requirement  to  match  information 
and  execution  authority  such  that  the  human's  actual  influence  over  the  technical 
process  as  defined  by  the  distribution  of  execution  authority  makes  him  or  her  want  to 
use  the  available  information  on  the  technical  system  as  defined  by  the  distribution  of 
information  authority.  Often  automatic  systems  provide  the  human  operator  with  a  lot  of 
information  without  assigning  him  or  her  functions  that  would  necessitate  the  use  of  this 
information.  In  incidents  that  involve  lack  of  acknowledgement  of  available  information, 
the  human  operator  is  often  held  responsible,  thereby  neglecting  problems  of  potentially 
too  much  information  (cf.  the  discussion  of  adequate  alarm  filtering,  e.g.  Papadopoulos 
&  McDermid,  2001)  and  of  too  few  incentives  to  continuously  monitor  all  information 
available  due  to  lack  of  action  requirements  for  the  human  operator. 

In  a  number  of  design  projects,  KOMPASS  has  proven  useful  especially  for  making 
explicit  and  for  provoking  controversial  discussions  of  the  fundamental  issue  of  control 
and  responsibility  in  socio-technical  systems.  Deriving  specific  consequences  in  terms 
of  decisions  on  function  allocation  has  often  been  difficult,  though,  due  to  the  large 
number  of  partially  interdependent  criteria.  In  order  to  overcome  these  difficulties,  a 
prototype  of  a  computer-supported  version  of  KOMPASS  was  developed  and  tested  in  a 
few  cases  (Davidsson  et  al.,  2002;  Jongkind  et  al.,  2002).  The  results  were  encouraging, 
but  to  date  the  prototype  has  not  yet  been  developed  into  a  fully  operational  method.  In 
doing  so,  great  care  would  also  have  to  be  taken  to  not  "automate"  function  allocation 
decisions  in  the  very  way  that  the  method  itself  tries  to  avoid. 
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In  addition  to  these  more  pragmatic  difficulties  with  methods  such  as  KOPMASS,  the 
basic  approach  of  demanding  complete  human  control  over  technology  may  be  wrong. 
This  fundamental  doubt  is  expanded  on  in  the  following  sections. 

6.3  Lack  of  human  control  over  technical  systems  as  core  of  "human 
unreliability" 

The  main  conclusion  of  incident  and  accident  analyses  across  industrial  sectors  is  that 
human  error  is  an  important  or  even  the  dominant  causal  factor.  At  the  same  time,  there 
is  more  and  more  acceptance  of  the  fact  that  accidents  are  always  caused  by  a  complex 
combination  of  human,  technical,  organizational,  social  and  environmental  factors, 
which  may  contain  latent  failures  that  only  through  erroneous  human  action  "at  the 
sharp  end"  will  actually  lead  to  accidents  (e.g.  Reason,  1997).  Bainbridge's  article  on 
the  ironies  of  automation  is  still  the  most  impressive  description  of  the  unfortunate 
coupling  of  human  and  technology: 

"(...)  the  automatic  control  system  has  been  put  in  because  it  can  do  the  job 
better  than  the  operator,  but  yet  the  operator  is  being  asked  to  monitor 
whether  it  is  working  effectively.  (...)  if  the  decisions  can  be  fully  specified 
then  a  computer  can  make  them  more  quickly,  taking  into  account  more 
decisions  and  using  more  accurately  specified  criteria  than  a  human  operator 
can.  There  is  therefore  no  way  in  which  the  human  operator  can  check  in 
real-time  that  the  computer  is  following  its  rules  correctly.  One  can 
therefore  only  expect  the  operator  to  monitor  the  computer's  decisions  at 
some  meta-level,  to  decide  whether  the  computer's  decisions  are  'acceptable'. 

If  the  computer  is  being  used  to  make  the  decisions  because  human 
judgement  and  intuitive  reasoning  are  not  adequate  in  this  context,  then 
which  of  the  decisions  is  to  be  accepted?  The  human  monitor  has  been  given 
an  impossible  task."  (Bainbridge,  1982,  pp.  130-131) 

A  frequently  cited  example  of  this  problematic  interaction  between  human  and 
technology  is  the  accident  of  a  Lufthansa  Airbus  A320  in  Warsaw,  where  the  automatic 
algorithm  -  with  no  manual  override  -  for  braking  the  aircraft  after  touchdown  on  the 
runway  was  instigated  too  late  resulting  in  the  aircraft  crashing  into  a  earthen  mound  at 
the  end  of  the  runway.  As  a  consequence  of  this  accident,  Lufthansa  pilots  were 
informed  in  more  detail  about  the  technical  definition  of  the  landing  procedure  and 
some  technical  improvements  of  the  Lufthansa  Airbus  airplanes  were  implemented.  The 
fully  automatic  -  i.e.  not  allowing  any  human  influence  -  release  of  reverse  thrust  and  of 
the  brakes  during  landing  was  left  unchanged. 

The  problems  resulting  from  taking  away  control  from  the  human  operator  in  this  way 
have  been  described  very  well  by  Amalberti  (1992,  1993).  He  assumes  that  human 
operators  act  on  the  basis  of  an  "ecological  risk  management": 

"In  summary,  pilots  know  they  are  resource  limited.  They  thus  develop 
sophisticated  strategies  to  adapt  to  task  demands.  The  problems  to  solve  are 
twofold.  The  first  is  to  switch  between  parallel  activities  directed  to 
different  temporal  horizons  with  the  safest  strategy.  In  absolute  terms  the 
safest  strategy  should  be  based  on  logical  tests,  but  this  is  too  demanding  in 
terms  of  resources  and  timely  calculations.  Pilots  compromise  between  risk 
and  efficiency,  basing  the  strategy  on  experience  and  redundancy.  Second  is 
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the  problem  of  preparing  responses  to  events.  Again,  pilots  know  that  they 
will  not  have  sufficient  resources  to  find  timely  relevant  solutions.  They 
prepare  these  solutions  far  before  action.  All  pilot  activity  is  then  directed  to 
keeping  the  flight  in  the  domain  (normal  and  abnormal)  which  has  been 
envisaged  before  the  flight.  Moreover,  pilots  organize  activity  in  this 
domain  to  avoid  transient  situations  in  which  prepared  responses  to  events 
would  not  be  applicable.  (...)  The  primary  qualities  of  the  model  of  risk 
management  are  anticipation  and  action.  Anticipation  has  no  value  if  it  is 
not  accompanied  with  active  behaviour  forcing  the  actual  to  suit  the 
anticipation  model.  The  reactive  model,  because  of  resource  constraints,  is 
restrained  to  the  minimum."  (Amalberti,  1992,  pp.  102-103) 

He  argues  further  that  this  way  of  dealing  with  risk  is  rendered  more  difficult  by 
automation  as  transparency  and  flexibility  are  lost.  Pilots  react  to  this  difficulty  by 
either  trying  to  outwit  the  technical  system  -  e.g.  entering  non-existent  wind  into  the 
computer  in  order  for  the  computer  to  calculate  a  different,  i.e.  the  desired,  approach 
angle  -  or  by  fully  delegating  the  responsibility  to  the  technical  system.  For  technology 
to  support  the  pilots'  ecological  risk  management,  system  designers  would  have  to 
consider  human  situative  problem  solving  strategies  more  instead  of  assuming 
prescriptive  optimal  strategies.  An  essential  prerequisite  would  be  to  see  humans  more 
as  a  safety  factor  instead  of  solely  as  a  risk  factor. 

6.4  Assumptions  about  the  nature  of  humans,  technology  and  organization  as  a 
basis  for  system  design 

The  importance  of  implicit  or  explicit  assumptions  underlying  system  design  that 
concern  the  role  of  humans  and  technology  in  the  overall  socio-technical  system  has 
been  pointed  out  by  Bailey  (1989).  He  distinguished  five  such  assumptions  (see  Table 
1).  Amalberti' s  argument  goes  further  in  assuming  that  by  regarding  the  human  as  a  risk 
factor  and  delegating  all  safety-critical  functions  to  technology  as  the  presumed  safety 
factor,  the  human  is  actually  turned  into  a  risk  factor.  A  self-fulfilling  prophecy  is 
created. 


Allocation  criterion 

Implicit  assumptioi 

Humans 

ns  about  the  nature  of 

Technology 

Cost  efficiency 

Cost  producing  factors 

Leftover 

Disturbance  and  risk  factor 

Effectiveness  and  safety  factor 

Performance  comparison 

Competing  factors 

Humane  tasks 

Valuable  resource 

Support  for  human  operator 

Flexible  allocation 

Valuable  resources 

Table  1.  Criteria  for  human-machine  function  allocation  and  underlying 
assumptions  (adapted  from  Bailey,  1989,  and  Wafler  et  al.,  2003). 

Methods  like  KOMPASS  try  to  change  assumptions  about  the  nature  of  humans  and 
technology  in  order  to  support  the  human  as  a  safety  factor.  In  doing  so  it  is  important 
to  also  question  assumptions  about  organisations,  i.e.  "images  of  organization"  (Morgan, 
1986),  especially  assumptions  concerning  planning  and  control  in  organizations. 
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The  tayloristic  view  on  organizations  presumes  that  at  least  the  essential  events  and 
processes  in  an  organization  can  be  fully  planned  in  advance  and  carried  out  as  planned. 
Generally  speaking  this  implies  that  organizations  as  fundamentally  open  systems  can 
be  turned  into  closed  systems  by  adequate  planning  and  control  (cf.  Weitz  &  Shenhav, 
2000).  Newer  organization  theory  (e.g.  Staehle,  1991;  Thompson,  1967;  Orton  &  Weick, 
1990)  emphasizes  that  uncertainties  should  not  be  avoided  at  any  price,  but  that 
proactive  handling  of  uncertainties  needs  to  be  supported  in  order  to  take  into  account 
the  simultaneous  rationality  and  indeterminacy  of  organizational  processes.  Abandoning 
the  myth  of  full  control  permits  constructive  coping  with  the  limits  of  planning, 
systematic  support  of  decentralized  autonomy,  and  deliberate  choices  between  local  and 
central  control  mechanisms.  Disturbances  are  not  taken  automatically  and  without 
question  as  signs  of  bad  planning  and  insufficient  efficiency,  but  -  also  -  as 
opportunities  for  individual  learning  and  systemic  development  (cf.  Grote,  1997). 

6.5  The  limits  of  control  over  technology 

For  such  a  change  in  perspectives  on  humans,  technology,  and  organization  to  take 
effect,  another  even  more  fundamental  assumption  is  needed.  This  assumption  states 
that  even  the  most  advanced  technology  would  still  be  controllable  by  human  operators 
if  system  designers  and  buyers  of  systems  were  willing  to  invest  more  resources  in  the 
development  of  these  systems. 

After  decades  of  trying  to  develop  theories  and  methods  to  affect  such  a  change  and  as  a 
consequence  design  better  systems,  the  meagre  overall  success  raises  doubts  about  this 
assumption.  What  if  the  insufficient  human  control  of  technology  is  not  caused  by 
normative  assumptions  about  humans,  technology,  and  organizations,  but  by  the  factual 
restrictions  on  the  controllability  and  more  basically  even  the  human  imagination  due  to 
the  ever  increasing  complexity  of  technology?  Then  either  further  technology 
development  has  to  be  stopped  or  the  (partial)  lack  of  control  has  to  be  accepted. 
Technically,  this  acceptance  is  equivalent  to  the  determination  of  unmanaged  residual 
risks.  On  the  human  side,  there  is  hesitance  to  admit  a  lack  of  control  due  to  problems  of 
unmanaged  responsibilities.  The  human  operator  is  kept  in  the  system  as  a  backup 
where  all  problems  come  together  and  have  to  be  handled.  The  fallibility  of  this 
approach  and  its  abuse  by  system  developers  and  the  organizations  operating  the 
systems  in  order  not  to  have  to  admit  the  lack  of  control  has  been  pointed  out  by 
Lisanne  Bainbridge  (1982)  with  utmost  clarity.  Polemically  one  could  argue  that  the 
current  boom  in  research  on  trust  in  technology  at  the  level  of  the  concrete  human- 
technology  interaction  (e.g.  Muir,  1994;  Moray,  Inagaki  &  Itoh,  2000)  has  its  roots  in 
the  fact  that  -  while  still  acknowledging  that  control  would  be  better  than  trust  -  trust  is 
all  that  is  left  to  the  human  operator.  Experiments  have  shown  technology  is  trusted 
when  trust  in  one's  own  competences  is  low  (e.g.  Lee  &  Moray,  1992,  1994).  From 
general  psychology  we  know  that  self-confidence  is  strongly  related  to  perceived 
personal  control. 

In  the  following,  it  is  presumed  that  technology  cannot  be  controlled  fully  by  human 
operators.  It  is  discussed  how  this  presumption  might  change  criteria  for  system  design 
and  how  system  design  might  benefit  from  this  change  in  perspective. 
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6.6  Guidelines  for  the  design  of  (partially)  non-controllable  technology 

The  main  purpose  of  such  new  design  guidelines  would  be  to  free  the  human  operator  of 
his  impossible  role  of  trying  to  fulfil  stop-gap  and  backup  functions  in  complex  socio- 
technical  systems.  Methods  supporting  adaptive  system  design  aim  in  a  similar  direction 
by  allocating  control  fully  and  without  human  influence  to  the  technical  system  in  very 
stressful  situations  (e.g.  Inagaki,  2000;  Moray,  Inagaki  &  Itoh,  2000).  However,  the 
crucial  issue  of  responsibility  is  usually  not  dealt  with  in  these  methods. 

According  to  Komwachs  (1999)  the  main  prerequisites  for  taking  on  responsibility  are 
the  freedom  to  make  choices  and  to  act  in  the  chosen  manner.  If  people  are  forced  to  act 
in  a  particular  way  they  cannot  be  held  responsible  unless  they  have  brought  this 
situation  upon  themselves.  Also,  he  argues  that  missing  knowledge  concerning  the 
action,  its  purpose  and  its  consequences  has  to  be  available  and  attainable.  He 
emphasizes  that  automation  attempts  to  reduce  complexity  for  the  human  operation  in 
order  to  achieve  these  preconditions,  but  that  at  the  same  time  new  complexities  are 
created  which  may  violate  these  conditions. 

Building  on  an  approach  which  attempts  to  provide  the  preconditions  for  taking  on 
responsibility  and  thereby  also  for  control,  the  limits  of  control  should  also  be  defined 
as  clearly  as  possible.  In  those  areas  which  are  classified  as  not  controllable  for  the 
human  operator,  he  cannot  be  held  responsible.  Taking  the  braking  procedure  in  the 
Airbus  A320  as  an  example,  this  would  mean  that  the  irreversible  automation  of  the 
essential  braking  functions  should  be  taught  in  pilot  training  and  should  also  be 
indicated  in  the  cockpit  during  landing.  If  mistakes  happen  in  the  execution  of  these 
functions,  the  system  developer  or  possibly  the  organization  operating  the  system 
should  be  held  responsible,  but  not  the  pilots.  Only  if  the  pilots  can  be  proven  to  have 
induced  this  situation  deliberately  or  carelessly  (e.g.  due  to  insufficient  competencies)  in 
line  with  Komwachs'  argument,  might  they  have  to  assume  some  of  the  responsibility. 

During  a  recent  workshop  on  the  opportunities  and  risks  of  pervasive  computing, 
similar  arguments  were  raised,  demanding  that  intransparency  and  uncertainty  in 
technical  systems  should  be  made  transparent  by  explicitly  pointing  them  out  (Meier, 
2005).  This  could  imply,  for  instance,  that  when  switching  on  an  RFID(radio  frequency 
identification)  application  -  such  as  the  milk  bottles  in  our  refrigerator  that  order  new 
milk  when  their  use-by-date  has  passed  -  the  user  is  informed  about  which  network 
connections  have  been  established  and  which  of  those  are  part  of  an  unprotected 
network.  Such  indications  do  exist  already  for  some  internet  applications.  If  the  user 
still  has  the  choice  to  not  use  the  connection,  the  responsibility  would  rest  with  him  or 
her.  In  cases  where  we  are  forced  to  use  such  connections,  we  would  take  note  of  the 
insecure  status  and  thus  lack  of  control  without  being  able  to  influence  the  situation,  but 
also  without  being  held  responsible. 

In  order  to  design  socio-technical  systems  according  to  such  guidelines,  existing 
methods  for  assessing  technical,  human,  and  organizational  risks  should  be  extended  to 
also  indicate  clearly  zones  of  uncontrolled  risks  for  both  the  organizations  operating  the 
system  and  the  human  operators  at  the  sharp  end.  As  much  as  possible  even  in  these 
zones  heuristics  should  be  provided  to  the  operator  to  help  him  or  her  cope  with  the 
uncertainties  and  to  regain  control.  Process  rules  as  defined  by  Hale  and  Swuste  (1998) 
could  be  such  heuristics.  At  the  same  time,  in  these  zones  the  responsibility  for  the  safe 
operation  of  the  system  would  remain  with  the  system  developer  and  potentially  the 


20 


IDIS  2005 


Grote 


system  user,  but  not  the  human  operator.  The  pressure  to  keep  these  zones  small  and 
thereby  maximize  control  for  the  human  operator  would  increase.  Something  similar  is 
achieved  already  by  US  law  allowing  system  operators  to  sue  the  system  developer 
when  his  or  her  own  erroneous  action  can  be  proven  to  be  a  consequence  of  bad  system 
design  (Baram,  in  press). 

A  method  for  risk  analysis  that  could  be  helpful  in  this  context  is  Hollnagel's  CREAM 
approach  (1998).  This  method  distinguishes  between  four  modes  of  control  of  the 
human  operator:  scrambled,  opportunistic,  tactical  and  strategic.  These  modes  of  control 
are  assigned  reliability  intervals  which  are  used  to  determine  the  probabilities  of  human 
errors  in  different  event  sequences.  Such  a  differentiation  might  also  be  useful  in 
identifying  zones  of  lack  of  control  for  the  human  operator  in  a  human-machine  system, 
in  which  only  scrambled  control  is  possible,  e.g.  due  to  the  unpredictability  of 
consequences  of  a  certain  event.  In  system  design,  it  would  have  to  be  decided  whether 
functions  in  such  zones  could  be  fully  automated  and  whether  the  human  operator  can 
be  in  any  way  supported  in  acting  appropriately  despite  his  or  her  reduced  control. 
Instead  of  pretending  that  systems  are  safer  than  they  are,  due  to  their  increasing 
embeddedness  in  complex  networks,  it  may  be  a  much  better  means  to  regain  control  by 
admitting  to  areas  of  intransparence  and  uncertainties  in  the  system,  as  then  coping  can 
be  trained  systematically. 

6.7  Final  remarks 

Much  of  what  has  been  said  in  this  paper  is  not  new  -  however  the  underlying  attitude 
may  be  new:  Instead  of  lamenting  the  lack  of  human  control  over  technology  and  of 
demanding  over  and  over  again  that  control  be  reinstated,  the  approach  presented  here 
assumes  very  explicitly  that  current  and  future  technology  contains  more  or  less 
substantial  zones  of  no  control.  Any  system  design  should  build  on  this  assumption  and 
develop  concepts  for  handling  the  lack  on  control  in  a  way  that  does  not  delegate  the 
responsibility  to  the  human  operator,  but  holds  system  developers,  the  organizations 
operating  the  systems,  and  societal  actors  accountable.  This  could  happen  much  more 
effectively  if  uncertainties  were  made  transparent  and  the  human  operator  were  relieved 
of  his  or  her  stop-gap  and  backup  function.  This  would  also  bring  us  closer  to 
Komwachs'  (1999)  requirement:  Act  in  a  way  that  keeps  the  conditions  for  responsible 
actions  of  all  involved  intact. 
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7.  GUIDA,  GIOVANNI  (WITH  GIACOMIN,  MASSIMILIANO;  ROSSI, 
MICHELE  &  VIOLA,  ANDREA);  A  KNOWLEDGE-BASED  DECISION 
SUPPORT  SYSTEM  FOR  CRISIS  MANAGEMENT  IN  THE  FIELD  OF 
PUBLIC  HEALTH 

7.1  Motivation 

The  project  discussed  in  this  paper  originates  from  a  practical  need.  The  management  of 
large-scale  emergency  situations  with  an  impact  on  public  health  is  a  complex  and 
multifaceted  problem.  It  involves  several  tasks  and  requires  that  several  reasoning  paths 
are  carried  out  in  parallel  by  the  persons  in  charge  of  crisis  management.  Crisis 
managers  operate  at  a  coarse  level;  they  are  not  involved  in  operative  details,  but  have 
responsibility  about  high-level  planning  and  allocation  of  resources.  In  particular,  they 
have  to  deal  with  the  following  main  aspects: 

•  acquiring  and  validating  information  from  the  field,  about  the  originating  events, 
their  consequences,  the  actions  undertaken  to  face  the  emergency  situation  and  their 
effects; 

•  assessing  the  situation  and  identifying  primary  needs; 

•  identifying  the  most  appropriate  intervention  plans  and  allocating  human  and 
instrumental  resources  to  the  activities  to  be  carried  out; 

•  activating  the  lower  operational  levels  according  to  the  identified  intervention  plans. 

All  these  threads  have  generally  to  be  carried  out  by  a  team  of  crisis  managers,  active  24 
hours  a  day,  even  for  rather  long  periods,  who  operate  under  pressure,  stress,  and 
responsibility  overload.  In  their  job,  they  have  to  exploit  all  available  knowledge  and 
experience,  apply  emergency  plans,  comply  with  general  regulations,  and  promptly 
respond  to  the  inputs  arriving  from  the  upper  management  at  local,  regional  or  national 
level. 

In  this  context,  a  decision  support  system  (DSS)  would  certainly  be  useful.  However, 
this  goal  raises  three  main  questions: 

1 .  What  is  the  core  problem  that  crisis  managers  have  to  face  in  their  job? 

2.  What  are  the  main  causes  of  complexity? 

3.  Which  are  the  key  decisions  that  must  be  made  by  crisis  managers? 

4.  What  type  of  support  would  be  appropriate  for  them? 

7.2  Methodological  issues 

Answering  the  above  four  questions  brings  to  light  the  main  methodological  issues 
behind  the  design  of  the  DSS. 

1.  What  is  the  core  problem  that  crisis  managers  have  to  face  in  their  job? 

Certainly,  the  core  problem  is  information  overload.  There  is  no  structuring  concept  in 
the  way  crisis  managers  receive  information  from  the  field:  information  arrives  at  any 
time,  uncontrolled,  and  unfdtered.  Crisis  managers  receive  a  lot  of  information,  but 
most  of  it  is  incomplete  and  provisional:  new  information  may  complement  or  even 
contradict  the  old  one. 

2.  What  are  the  main  causes  of  complexity? 

The  complexity  of  the  crisis  managers’  job  primarily  derives  from  the  fact  that  they  are 
involved  in  too  many  tasks  at  the  same  time.  They  have  to  take  care  of  a  very  large 
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number  of  aspects  that  range  from  very  important  issues  to  trivial  details.  It  is  difficult 
for  them  to  separate  easy  decisions  that  can  be  made  on  the  basis  of  known,  simple  rules 
from  complex  decisions  that  require  careful  consideration  and  involve  high 
responsibility. 

3.  Which  are  the  key  decisions  that  must  be  faced  by  crisis  managers? 

Crisis  managers  are  faced  with  two  types  of  decisions: 

•  Which  action  plan  to  apply  in  response  to  an  event? 

•  How  to  allocate  the  available  resources  to  the  actions  of  the  active  plans? 

4.  What  type  of  support  would  be  appropriate  for  them? 

Neither  an  informative  nor  a  normative  approach  would  be  definitely  appropriate  to 
support  the  crisis  managers  in  their  job.  Informative  support  would  be  certainly  useful 
in  providing  a  structured,  clear  and  focused  representation  of  the  events,  but  in  the  end  it 
would  turn  out  to  be  weak  and  unable  to  cope  with  the  complexity  of  the  problem. 
Normative  support  is  simply  impossible,  due  to  the  variety  of  situations  that  may  arise 
and  to  the  fact  that  crisis  managers  are  personally  responsible  of  the  decisions  they 
make. 

7.3  The  focused  approach  to  decision  support 

In  this  context,  a  novel  approach  to  decision  support  has  emerged,  called  a  focused 
approach.  A  deep  analysis  of  the  application  domain  has  revealed  that  the  majority  of 
decisions  that  have  to  be  made  by  crisis  managers  are  not  critical  and  can  be  made  on 
the  basis  of  available  domain  knowledge;  only  a  small  number  of  decisions  are  really 
critical  and  require  the  attention  of  crisis  managers.  Therefore,  the  following  schema  to 
decision  support  has  been  identified: 

•  Non  critical  decisions  can  be  supported  through  a  normative  approach.  In  fact, 
existing  regulations,  stated  emergency  plans  and  available  experience  of  previous 
cases  provide  a  rich  and  reliable  knowledge  base  for  decision  making. 

•  This  way,  crisis  managers  are  allowed  to  focus  only  on  critical  decisions  that 
definitely  require  their  intervention.  Therefore,  their  cognitive  resources  are  not 
dispersed  among  a  number  of  trivial  choices,  but  are  focused  on  a  small  set  of 
crucial  aspects,  namely:  the  selection  among  alternative  intervention  plans  and  the 
allocation  of  resources. 

•  For  all  critical  decisions  crisis  managers  receive  an  informative,  structured  decision 
support.  The  decisions  to  be  made  are  presented  in  a  disciplined  and  clear  way  and 
are  supported  by  additional  specific  decision  information  useful  to  identify  and  rate 
possible  alternatives. 

7.4  Organization  issues  and  design  criteria 

Crisis  managers  have  been  partitioned  into  three  professional  roles: 

•  Information  managers,  in  charge  of  collecting  and  validating  data  and  information 
arriving  from  the  field; 

•  Resource  managers,  in  charge  of  monitoring  data  about  available  resources  to  be 
used  in  crisis  management; 

•  Decision  makers,  in  charge  of  high-level  decisions  necessary  to  manage  the 
emergency  in  the  most  suitable  and  effective  way. 
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The  DSS  provides  specific  support  to  all  these  categories,  through  dedicated  views. 
Information  managers  interact  with  the  DSS  through  an  event  frame  that  supports  them 
in  the  analysis  of  incoming  data  and  in  their  correct  representation  through  the  system 
interface.  This  way,  all  relevant  events  occurring  in  the  field  are  taken  in  input  by  the 
system,  after  necessary  validation.  The  event  frame  also  reminds  information  managers 
about  expected  events  and  prompts  them  to  undertake  the  necessary  investigations  in 
case  they  fail  to  manifest. 

Resource  managers  operate  through  the  resource  frame  that  supports  them  in  the  real 
time  updating  of  the  database  of  available  resources,  both  human  and  instrumental. 

Decision  makers  work  in  parallel  with  two  frames  (presented  on  separate  screens).  The 
plan  frame  presents  to  the  decision  makers  the  plans  that  should  be  activated  in  front  of 
the  occurred  events,  and  helps  them  to  make  decisions  about  possible  alternatives  to  be 
chosen  during  plan  execution;  to  this  purpose,  alternatives  are  analyzed  by  the  DSS 
according  to  stated  criteria  and  ranked  accordingly.  The  action  frame  helps  the  decision 
makers  to  allocate  available  resources  to  the  actions  of  the  currently  active  plans,  in 
such  a  way  as  to  avoid  that  actions  might  be  started  without  the  minimal  necessary 
resources  and  to  support  effective  load  balancing. 

This  organizational  setting  turned  out  to  be  the  minimal  one  to  support  this  complex 
task. 

7.5  Implementation  and  experimentation 

The  decision  support  system  is  presently  under  development.  A  first  prototype  will  be 
completely  running  by  the  end  of  2005  (a  first  version  is  already  available),  designed  to 
run  in  a  distributed  environment,  and  developed  in  Java  environment  (with  open  source 
software  components).  It  deals  with  an  earthquake  scenario  and  concerns  three  sample 
cases,  chosen  to  demonstrate  system  potential,  namely:  possible  pollution  in  the 
aqueduct  of  a  town,  damages  to  a  high-risk  factory  that  might  cause  an  environmental 
disaster,  unavailability  of  regular  home  assistance  for  patients  requiring  special  care. 

7.6  Limitations  of  decision  support  and  an  approach  to  robustness 

Clearly,  the  capabilities  of  the  DSS  strictly  depend  on  the  ability  to  model  a  large  set  of 
possible  cases  and  events,  as  well  as  on  the  availability  of  knowledge  to  deal  with  them. 
The  DSS  operates  on  the  basis  of  compiled  knowledge  (it  does  not  rely  in  first 
principles  or  deep  models  of  the  domain,  to  a  large  extent  simply  impossible  to  elicit): 
effective  and  correct  operation  ends  exactly  where  knowledge  starts  to  be  lacking. 

The  capabilities  of  the  DSS  can  be  compromised  in  at  least  two  cases:  not  only  when  the 
occurring  events  are  not  covered  by  the  available  knowledge  base,  but  also  when  the 
crisis  managers  do  not  accept  the  prescriptions  or  the  suggestions  of  the  system  and 
make  decisions  strongly  contrasting  with  the  DSS  model  of  reasoning.  In  both  cases  the 
system  becomes  rapidly  unable  to  react  to  further  inputs  and  can  not  control  the 
evolution  of  the  emergency  situation  any  more. 

To  improve  the  robustness  of  the  DSS,  two  strategies  are  envisaged.  At  a  first  level,  the 
DSS  is  programmed  to  point  out  to  the  user  the  case  when  it  starts  operating  at  the  limits 
of  its  competence  domain  and,  therefore,  its  advice  is  becoming  more  and  more 
unreliable.  Furthermore,  after  this  point  has  been  trespassed,  the  system  can  change  its 
state  and  start  working  according  to  an  experimental  schema,  where  the  decisions  of  the 
user  overwrite  system  knowledge  and  become  the  basis  for  future  DSS  operation.  The 
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system  tries  to  apply  its  own  knowledge  as  far  as  possible  and,  when  it  turns  out  to  be 
inapplicable,  it  resorts  to  new  knowledge  directly  derived  from  recent  user  interactions. 
This  way,  new  knowledge  is  accumulated  during  experimental  operation  that  can  later 
be  analyzed  and  -  if  appropriate  -  used  to  expand  the  permanent  knowledge  base  of  the 
DSS. 


28 


IDIS  2005 


Hoffman 


8.  HOFFMAN,  ROBERT:  POSITION  STATEMENT 

1 .  Cognitive  Systems  Engineering  has  matured  to  a  point  where  it  is  feasible  to 
commence  a  collaborative  effort  to  forge  a  unified  Theory  Of  Complex  And  Cognitive 
Systems  (TOCACS).  (See  the  Bibliography.) 

2.  Version  1.0  consists  of  postulates  that  fall  into  classes  including:  A  Metatheory,  Laws 
of  Cognitive  Work,  Design  Challenges,  and  Measurement. 

3.  The  Metatheory  asserts  a  systems  stance.  It  specifies  ways  in  which  postulates  can  be 
refuted  and  inferences  from  the  theory  can  be  disconfirmed  (via  “forced  inconsistency”), 
and  it  includes  postulates  concerning  completeness  and  consistency. 

The  metatheory  specifies  what  is  meant  by  "law." 

•  The  laws  within  the  theory  have  mnemonic  value,  they  express  cautionary  tales, 
and  they  are  empirical  generalizations. 

•  But  they  are  more  that  this:  They  are  extensional  (i.e.,  they  refer  to  classes)  and 
nomological  generalizations  (i.e.,  they  are  universal  given  certain  boundary 
conditions). 

•  The  issue  then  is  how  they  can  be  inviolate.  This  is  where  a  notion  of  "goodness" 
plays  a  critical  role  in  the  theory. 

•  The  metatheory  cannot  be  carved  away  from  the  Laws.  For  example,  the  teams  of 
people  and  machines  that  design  CACSs  themselves  constitute  a  CACS,  and  so 
are  prone  to  reductive  explanation  tendencies  and  the  trap  of  designer-centered 
design  (e.g.,  The  road  to  user-hostile  systems  is  paved  with  user-centered 
intentions). 

4.  The  Laws  of  Cognitive  Work  specify  the  empirical  regularities  in  terms  of  families  of 
functions,  including: 

Forces  that  promote  stability  and  resistance  to  change 

•  e.g.,  The  Penny  Foolish  Law:  Any  focus  on  short-term  cost  considerations  always 
comes  with  a  hefty  price  down  the  road,  that  weighs  much  more  heavily  on  the 
shoulders  of  the  users  than  on  the  shoulders  of  project  managers. 

•  e.g.,  The  Cognitive  Vacuum  Law:  When  working  as  a  part  of  a  CACS,  people  will 
perceive  patterns  and  derive  understandings  and  explanations,  and  these  are  not 
necessarily  either  veridical  or  faithful  to  the  intentions  of  the  designers. 

•  Forces  that  lead  to  instability  and  momentum 

•  e.g.,  The  Law  of  Stretched  Systems:  CACSs  are  always  stretched  to  their  limits  of 
performance  and  adaptability.  Interventions  will  always  increase  the  tempo 
andintensity  of  activity). 

•  e.g.,  Rasmussen’s  Law:  In  cognitive  work  within  a  CACS,  people  do  not  conduct 
tasks,  they  engage  in  context-sensitive,  knowledge-driven  choice  among  action 
sequence  alternatives. 
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•  Forces  that  contribute  to  (or  detract  from)  alignment  or  coordinative  symmetry. 

•  e.g.,  Dilberf  s  Law:  A  human  will  not  cooperate,  or  will  not  cooperate  well  with 
another  agent  if  it  is  assumed  that  the  other  agent  is  not  competent. 

•  e.g.,  Mr.  Weasley’s  Law:  Humans  should  be  supported  in  rapidly  achieving  a 
veridical  and  useful  understanding  of  the  “intent”  and  “stance”  of  the  machines. 

5.  The  Design  Challenges  are  entailed  by  the  Laws,  and  specify  the  features  of  the 
"good"  CACS. 

•  These  are  offered  as  candidates  for  adoption  as  design  policies  in  procurement. 

•  e.g.,  The  Sacagawea  Challenge:  The  good  CACS  supports  active  organization  of 
information,  active  search  for  information,  active  exploration  of  information, 
reflection  on  the  meaning  of  information,  and  evaluation  and  choice  among  action 
sequence  alternatives. 

•  e.g.,  The  Pleasure  Challenge:  The  good  CACS  instills  in  the  humans  a  feeling  of 
direct  engagement.  They  simultaneously  provide  a  feeling  of  flow  and  challenge. 

•  The  notion  of  goodness  will  be  critical  to  the  theory,  and  is  anchored  in  additional 
postulates  concerning  measurement. 

6.  Many  of  the  TOCACS  postulates  have  Corollaries. 

Example:  Corollary  to  Rasmussen’s  Law:  When  it  appears  as  if  people  are  conducting 
tasks,  that  is  either  because  the  activity  is  routine  and  requires  no  choice,  or  because  a 
task  procedure  is  mandated. 

7.  Finally,  the  postulates  in  TOCACS  have  multiple  entailment  relations  with  one 
another.  They  “hang  together”  in  necessary,  interesting,  and  useful  ways. 

•  Example  entailment: 

The  Godelian  Postulate:  TOCACS  is  necessarily  incomplete. 

The  Reductive  Explanation  Law:  In  the  struggle  to  assimilate  new  knowledge, 
explanations  (at  any  given  time)  will  inevitably  involve  simplifications. 

•  Example  entailment: 

Envisioned  World  Law:  New  technologies  are  hypotheses  about  how  work  will  change. 
Moving  Target  Law:  The  context  of  cognitive  work  is  itself  always  changing. 

•  The  entailment  relations  point  to  interesting  ways  in  which  the  Laws  interact,  and 
some  provide  necessary  and  strong  linkages  between  the  metatheory  and  the  other 
classes  of  postulates.  They  also  help  justify  the  claim  that  the  postulates  in 
TOCACS,  as  a  set,  constitute  a  scientific  theory. 

8.  Development  of  the  theory  will  require  a  continuing  collaborative  effort;  the  theory 
will  be  periodically  updated  and  refined. 
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9.  HOLLNAGEL,  ERIK:  DIMENSIONS  OF  DECISION-MAKING  -  WHAT, 
HOW  AND  WHEN 

Decision-making  has  traditionally  been  about  choosing  an  alternative,  i.e.,  what  to  do  in 
order  to  ensure  that  a  desired  outcome  obtains.  This  tradition  is  usually  associated  with 
Blaise  Pascal  and  the  invention  of  probability  calculus,  but  can  be  found  even  earlier.  It 
may  even  be  seen  as  having  roots  in  the  general  human  need  to  attain  desired  outcomes 
in  life  -  and  in  what  may  come  after  that.  Decision  theories  have  therefore  very  much 
been  concerned  with  the  ‘what’  of  decision-making  and  there  is  not  shortage  of 
recommendations  -  or  even  norms  -  on  how  to  make  the  right  decision. 

Decision-making  is  in  practice,  however,  also  very  much  a  question  of  how  to  do  things 
and  when  to  do  them.  The  ‘how’  can  in  the  manner  of  recursion  be  seen  as  a  decision 
about  what  the  right  means  of  implementation  are,  although  that  in  itself  is  not 
independent  of  the  choice  of  alternatives  in  the  first  place.  Information  about  how 
alternatives  can  be  realised  may  thus  be  considered  an  additional  dimension  to  the 
utility,  which  in  one  form  or  another  is  supposed  to  affect  or  even  determine  choices. 
This  can  lead  to  interesting  discussions  of  how  the  values  of  alternatives  can  be 
established  in  the  first  place. 

The  ‘when’,  on  the  other  hand,  cannot  be  subsumed  by  the  common  decision-making 
paradigms  in  the  same  easy  manner.  Indeed,  many  decision  models  and  decision¬ 
making  theories  seem  conveniently  to  disregard  the  existence  of  time  or  at  least  to  make 
the  assumption  that  decisions  are  made  so  quickly  that  changes  in  the  environment  are 
of  no  consequence.  Decision-making  is  thus  considered  as  a  process  in  individuals  or 
organisations  rather  than  an  activity. 

However,  if  we  consider  decision-making  as  an  activity  in  the  manner  of  ‘naturalistic 
decision-making  and  ‘cognition  in  the  wild’  rather  than  as  a  ‘rational’  process,  a  number 
of  the  traditional  assumptions  have  to  be  discarded,  for  instance: 

•  Decision-making  is  not  a  discrete  and  identifiable  event,  but  rather  an  attribution 
after  the  fact.  That  it  is  possible  to  look  back  at  a  specific  event  or  activity  and 
identify  parts  where  a  decision  ‘must’  have  been  made,  does  not  necessarily  mean 
that  the  people  who  were  involved  made  an  explicit  decision  at  the  time. 

•  Decision-making  is  not  primarily  a  choice  among  alternatives.  It  is  very  difficult 
in  practice  to  separate  decisions  from  what  is  otherwise  needed  to  achieve  a 
decision-maker’s  objectives.  Although  a  decision  cannot  be  made  without  some 
information  about  the  situation,  the  demands,  and  the  possibilities  of  action,  the 
quality  and  quantity  of  that  information  may  indirectly  favour  one  outcome  rather 
than  another.  In  most  cases  a  decision  also  requires  actions  to  ensure  that  the 
expected  outcomes  obtain.  It  is  therefore  arbitrary  to  restrict  the  term  decision¬ 
making  to  the  ‘moment  of  choice’  and  disregard  what  goes  on  before  and  after. 

•  Decision-making  is  usually  not  a  distinct  event  that  takes  place  at  a  specific  point 
in  time,  or  within  a  certain  time  window  and  which  therefore  can  be  dissociated  or 
isolated  -  even  if  ever  so  briefly  -  from  what  goes  on  in  the  environment. 

There  are  some  really  fundamental  problems  arising  from  the  fact  that  decision-making 
as  an  activity  takes  time  and  therefore  requires  that  the  information  it  uses  remains  valid 
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while  the  decision  is  made.  (This  is,  of  course,  not  only  a  problem  for  decision-making 
but  for  all  human  actions.)  Yet  despite  the  importance  of  time  few  models  of  either 
decision-making  -  or  of  human  behaviour  in  general  -  have  taken  that  into  account.  In 
the  view  of  cognitive  systems  engineering,  decision-making  is  a  part  of  how  people  try 
to  cope  with  a  complex  and  dynamic  environment,  and  is  therefore  an  issue  about  how 
and  when  to  do  something,  as  much  as  an  issue  about  what  to  do. 

In  consequence  of  this,  the  issue  of  decision  support  changes  completely.  First  of  all  it  is 
not  just  an  issue  of  automation,  since  decision-making  cannot  be  automated  without 
ceasing  to  be  decision-making.  Whereas  automation  is  feasible  for  situations  that  are 
highly  regular,  hence  can  be  analysed  completely  in  advance,  decision  support  is  needed 
for  situations  that  are  irregular  and  unpredictable,  which  makes  prior  analyses  difficult 
or  impossible.  The  support  must  first  and  foremost  be  closely  integrated  with  the  task 
and  therefore  be  continuous  rather  than  discrete.  Any  discussion  about  ‘intelligence’  in 
decision  support  must  also  change.  Since  the  intelligence  clearly  cannot  be  in  the 
support  but  must  reside  in  the  decision  maker  (as  an  individual  or  a  group),  we  should 
strive  to  support  intelligent  decisions  and  intelligent  implementations  rather  than  build 
intelligent  support  systems.  In  that  sense  the  implementation  issues  (‘how’,  ‘when’,  etc. 
rather  than  ‘what’)  become  issues  of  maintaining  control,  and  of  regaining  control  if  it  is 
lost,  rather  than  of  supporting  decision  making  as  a  mental  process. 
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10.  INAGAKI,  TOSHIYUKI:  VIEWPOINTS  FOR  DESIGNING  HUMAN 
INTERACTIONS  WITH  INTELLIGENT  AND  AUTONOMOUS  MACHINES 

Various  efforts  have  been  exerted  to  improve  safety  of  transportation  systems,  such  as 
aircraft,  automobile,  railroad,  and  marine  vessels.  Accidents  rates,  however,  are  not  low 
enough.  One  of  the  reasons  may  be  that  advanced  functionalities  and  speeding  up  of 
those  transportation  systems  impose  human  operators  excessive  claims  on  their  abilities 
for  situational  recognition,  decision-making,  and  action  implementation.  Another  reason 
may  lie  in  autonomy  and  intelligence  of  operator  support  systems.  Intelligent  machines 
can  sense  and  analyze  situations,  decide  what  must  be  done,  and  implement  control 
actions.  Humans  working  with  such  intelligent  machines  often  suffer  negative 
consequences  of  automation,  such  as  the  out-of-the-loop  performance  problem,  loss  of 
situation  awareness,  complacency  or  over-trust,  and  automation-induced  surprises. 

Human-machine  collaborations  may  be  heavily  dependent  on  the  transportation  modes. 
Some  viewpoints  are  necessary  to  identify  what  functionalities  are  required  for  operator 
support.  I  would  like  to  discuss  two  of  those  viewpoints:  (1)  quality  of  human  operators 
and  (2)  time-criticality. 

Quality  of  human  operators  varies  depending  on  modes  of  transportation.  For  non¬ 
professional  operators,  such  as  private  car  drivers,  it  is  not  appropriate  to  assume  that 
they  have  high  level  of  knowledge  and  skills,  or  thorough  and  continual  training,  which 
implies  that  required  driver  assistance  functionalities  may  be  quite  different  from  those 
for  professional  operators,  such  as  airline  pilots  or  train  drivers. 

Time-criticality  also  differs  appreciably  depending  on  transportation  modes.  Suppose  a 
warning  has  been  set  off.  If  it  was  a  resolution  advisory  (RA)  of  traffic  alert  and 
collision  avoidance  systems  for  aircraft,  the  estimated  time  to  closest  point  of  approach 
must  be  15  to  35  seconds,  and  pilots  are  supposed  to  respond  to  the  RA  within  5 
seconds.  If  it  was  a  collision  warning  on  the  car,  on  the  other  hand,  it  may  have  been 
given  just  a  few  seconds  prior  to  a  possible  collision. 

Noting  the  above  two  points,  I  would  like  to  discuss  how  we  should  design 
functionalities  for  assisting  human  operators  appropriately  and  context-dependently. 
Discussions  may  be  made  on  two  aspects:  Enhancement  of  situation  awareness,  and 
design  of  authority. 

Human  interface  design  is  central  for  enhancing  situation  awareness,  avoiding 
automation  surprises,  establishing  appropriate  trust  in  automation.  The  implemented 
human  interface  must  enable  the  human  to:  (1)  Recognize  intention  of  the  automation, 
(2)  Understand  why  the  automation  thinks  so,  (3)  Share  the  situation  awareness  with  the 
automation,  and  (4)  Show  limits  of  functional  abilities  of  the  automation.  The 
enhancement  of  situation  awareness  matches  well  with  the  human-centered  automation 
concept,  in  which  human  locus  of  control  is  claimed. 

On  the  other  hand,  design  of  authority  may  claim  that  the  final  authority  should  be 
shared  between  humans  and  machines  in  a  context-dependent  manner,  which  may 
sometimes  conflict  with  the  human  locus  of  control  principle.  However,  high  level  of 
automation  (LOA)  may  be  vital  for  assuring  systems  safety.  I  will  show  three 
approaches  for  choosing  an  appropriate  LOA  by  predicting  how  the  LOA  may  affect 
humans  and  change  their  behaviors. 
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11.  JOHANSSON,  BJORN:  COGNITIVE  CONTROL  TOOL  -  A 
REFLECTION  ON  THE  TERM  “INTELLIGENT  DECISION  SUPPORT 
SYSTEM” 

Abstract 

Below,  we  will  argue  that  the  term  “Intelligent  Decision  Support  Systems”  is 
misleading  and  should  be  replaced  with  a  new  term.  The  following  arguments  are 
presented:  1.)  it  is  unclear  what  is  meant  by  intelligent,  and  in  what  sense  a  decision 
support  can  be  intelligent,  2.)  decisions  are  important,  but  it  is  not  justifying  to  call  it 
decision  support,  since  the  decision  actually  only  is  a  very  limited  part  of  the  control 
task,  3.)  “support  system”  indicates  that  only  a  certain  part  of  the  control  system  is 
supported,  but  the  way  we  use  the  term  is  too  vague.  From  literature,  it  seems  that 
everything  from  presenting  data  to  full  automation  is  seen  as  decision  support. 

To  avoid  confusion,  a  new  term  that  takes  a  stance  in  the  purpose  activity  (control) 
rather  than  a  vague  notion  like  intelligence,  and  that  avoids  the  focus  on  a  specific  step 
(decision  making)  in  that  task  is  suggested.  The  term  “Cognitive  Control  Tool” 
(CoCoTo)  is  suggested.  A  cognitive  control  tool  is  a  tool  that  is  designed  to  increase 
one  or  more  of  the  cognitive  functions  of  a  controller  (observation,  identification, 
evaluation,  decision,  planning).  In  order  to  create  a  cognitive  control  tool,  the  goal  of 
the  task  must  be  understood,  as  well  as  the  limitations  in  human  handling  of  the  task. 

11.1  Intelligent  Decision  Support  Systems 

Within  the  field  of  Intelligent  Decision  Support  Systems  (IDSS),  we  are  interested  in  a 
wide  range  of  systems  that,  based  on  models  of  human  cognition,  provides  support  for 
decision  in  various  forms,  ranging  from  suggestions  of  actions  to  pure  information 
presentation.  The  types  of  tasks  that  the  IDSS  is  designed  for  may  also  range  from 
expert  systems  to  systems  focusing  on  information  presentation,  demonstrating  that  the 
underlying  models  and  available  data  in  the  IDSS  vary  greatly. 

The  common  reference  is  (or,  perhaps  should  be)  that  all  systems  labeled  “intelligent 
decision  support”  have  been  built  with  the  purpose  of  guiding  a  human  decision  maker 
during  a  cognitively  demanding  task.  If  the  system  is  used  it,  in  a  sense,  becomes  a  part 
of  the  operator’s  cognition,  since  it  affects  the  decisions,  and  consequently  actions,  that 
the  operator  chooses.  The  IDSS  thus  becomes  a  part  of  the  cognitive  system,  a  cognitive 
system  with  its  own  intentions  and  goals,  although  these  intentions  have  been  built  into 
the  system  by  someone  else.  The  IDSS  simply  turns  into  a  part  of  the  controlling  system, 
and  indeed  an  essential  part. 

11.2  What  do  we  mean  by  “intelligent”,  “decision”  and  “support”? 

The  term  “intelligent  decision  support”  is  somewhat  fuzzy.  During  the  last  meeting  in 
1985,  there  seems  to  have  been  difficult  to  conclude  what  really  was  meant  by  the  term 
“intelligent  decision  support”.  Duncan  (1985)  writes  in  his  summary  of  the  panel 
discussion  on  cognitive  engineering  that 

“Not  unpredictably,  there  was  little  enthusiasm  to  define  the  intelligent 
component  of  decision  support . . .  Ultimately  the  goal  is  not  so  much  to 
build  an  ‘intelligent’  aid  as  it  is  to  build  an  aid  that  helps  the  human  act 
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more  intelligently.” 

(Duncan,  1985,  pp  447) 

The  last  sentence  is  however  recursive  in  the  sense  that  it  does  not  explain  “intelligent” 
by  any  other  means  than  reference  to  the  term  itself.  Hollnagel,  Mancini  &  Woods 
makes  an  effort  to  establish  a  functional  view  on  intelligence  in  the  concluding  chapter 
of  the  book. 

“Referring  to  a  Man-machine  System  as  being  intelligent  certainly  implies 
that  there  is  something  in  it  over  and  above  human  intelligence;  otherwise 
every  system  that  included  human  beings  -  as  most  systems  do  -  would 
deserve  the  label  ‘intelligent’ . . . 

However,  even  if  we  do  not  know  exactly  what  intelligence  is,  we  know 
how  it  functions  and  what  role  it  plays  in  dealing  with  process  environments 
as  well  as  in  daily  life.  We  can  therefore  from  a  purely  functional 
understanding  improve  the  conditions  for  use  of  human  intelligence  by 
amplifying  its  effect  on  the  environment.” 

(Hollnagel,  Mancini  &  Woods,  1985,  pp  465-466). 

Two  important  points  occur  in  this  quote.  In  the  first  sentence,  the  authors  note  that  the 
term  “intelligent”  suggests  that  a  system  with  an  IDSS  must  be  something  more  than  a 
system  without  IDSS.  In  the  second  sentence,  they  admit  that  there  is  an  uncertainty  in 
the  actual  meaning  of  the  term  intelligent,  but  still  suggests  that  it  could  be  understood 
in  terms  of  amplification  of  the  effects  of  it.  It  is  a  somewhat  problematic  statement 
since  it  still  does  not  help  us  to  understand  what  intelligent  means.  Another  view  of 
“intelligent”  in  relation  to  IDSS  could  naturally  be  that  the  system  adapts  to  the  operator 
or  to  changes  in  the  environment.  The  term  used  to  describe  such  systems  today  is 
“adaptive”,  and  that  is  probably  a  more  reasonable  notion. 

A  quick  browse  in  some  dictionaries  is  not  very  helpful  either.  The  term  intelligent 
“stresses  success  in  coping  with  new  situations  and  solving  problems”  1  or,  “revealing  or 
reflecting  good  judgment  or  sound  thought”,  alternatively  “the  ability  to  learn, 
understand  and  make  judgments  or  have  opinions  that  are  based  on  reason”2.  Similar 
definitions  appear  in  most  dictionaries.  It  seems  as  if  there  is  some  kind  of  agreement 
upon  definition  that  intelligent  means  “having  the  capacity  to  understand  a  situation  and 
reason  in  a  rational  way  to  find  the  best  way  to  handle  it”,  like  in  normative  decision 
making. 

This  brings  us  to  the  next  question.  What  do  we  mean  by  the  term  “decision”?  Many 
directions,  for  example  dynamic  decision  making  (Brehmer,  1992)  or  Naturalistic 
Decision  Making  (NDM,  Klein  et  al,  1993;  Klein,  1998)  focus  on  the  process  of  making 


1  Merriam- Webster  Online  dictionary,  http://www.m-w.com 

2  Cambridge  Advanced  Learner’s  dictionary  http://dictionary.cambridge.org/ 
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decisions.  Decisions  are  an  important  part  of  a  controlling  task.  Much  of  our  basic 
knowledge  about  decision  making  is  based  on  research  on  “toy”  examples,  mainly 
concerning  controlled  problems  were  it  is  possible  to  determine  whether  there  is  a 
solution  to  the  problem  or  not.  In  such  examples,  researchers  often  aimed  at  examining 
if  subjects  are  able  to  find  the  “best”  solution  in  a  normative  sense  (for  example  the 
tower  of  Hanoi,  Simon  1975).  This  view  is  called  normative  decision  making. 

There  are  some  basic  assumptions  about  the  rational  decision-maker  such  as  that  the 
decision-maker  is  completely  informed,  is  infinitely  sensitive  and  always  rational. 
Today  we  know  that  not  even  when  the  two  first  assumptions  are  fulfilled,  it  is  not 
guaranteed  that  the  decision-maker  acts  rationally.  The  most  important  criticism  against 
the  rationalistic  view  has  been  presented  by  the  natural  decision  making-paradigm 3 
(Klein,  1998).  Researchers  like  Klein  et  al.  (1993)  and  others  have  suggested  that  real- 
world  decision  making  is  a  fundamentally  different  task  than  the  tasks  that  have  been 
examined  in  traditional  problem-solving/decision-making  research.  Real-world 
decision-making  is  usually  faced  with  ill-defined  goals,  a  large  and  very  complex 
problem-space,  lack  of  time  and  other  aspects  that  create  uncertainty  (dynamic 
situations).  There  are  several  models  of  decision  making  available  today,  but  most  of 
them  share  the  following  components.  First,  a  decision  has  to  be  activated,  i.e.  there 
must  be  a  need  of  making  a  decision.  A  typical  example  would  be  if  some  kind  of  alarm 
sounds  of  in  a  nuclear  reactor  control  room.  The  first  thing  that  the  operators  would 
need  to  do  is  to  identify  the  source  of  the  alarm.  After  this,  he/she  evaluates  the  effects 
of  the  identified  alarm.  Which  action  should  be  taken?  The  operator  must  make  a 
decision.  The  decision  may  then  have  to  be  planned,  depending  on  the  goal  of  the 
decision,  before  it  can  be  executed. 

As  described  in  the  paragraph  above,  as  well  as  in  most  literature  concerning  decision 
support  systems,  the  “decision”  is  in  focus.  But  what  do  we  really  mean  by  the  term 
decision  “support”  in  this  case?  Dekker  &  Woods  (1999)  has  (based  on  Sheridan’s 
work)  proposed  10  levels  that  can  be  used  to  classify  a  support  system  (originally  levels 
of  supervisory  control): 

1.  offers  no  assistance,:  human  supervisor  must  do  it  all; 

2.  offers  a  complete  set  of  action  alternatives,  and 

3.  narrows  the  selection  down  to  a  few,  or 

4.  suggests  one,  or 

5.  executes  that  suggestion  if  the  supervisor  approves,  or 

6.  allows  the  supervisor  a  restricted  time  to  veto  before  automatic  execution,  or 

7.  executes  automatically,  then  necessarily  informs  the  supervisor,  or 

8.  informs  him/her  after  execution  only  if  he  asks,  or 

9.  informs  him/her  after  execution  if  the  subordinate  decides  to 


3 


Although  the  fact  that  decision-making  rarely  is  based  on  rational  reasoning  has  been  known  for  a  long 
time,  see  for  example  Lindblom  (1959),  or  Domer  (1989). 
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10.  decides  everything  and  acts  autonomously,  ignoring  the  supervisor. 

(Dekker  &  Woods,  1999,  pp  88) 

In  the  case  of  IDSS,  a  system  performing  in  accordance  with  points  7-10  does  more 
than  supporting  a  decision,  the  system  actually  executes  actions  and  is  thus  more  of  an 
automat,  or  a  controlling  system  than  a  “decision  support”. 

11.3  Decisions  and  control 

The  step  from  decision  to  execution  is  crucial  if  we  want  to  understand  what  an  IDSS 
really  is  designed  for.  To  only  discuss  decisions  is  too  hypothetical  to  be  meaningful 
since  the  actual  task  that  is  at  hand  is  control.  In  this  paper,  a  cybernetic  perspective  on 
control  is  used  (Ashby,  1956).  Control  is  the  task  of  affecting  a  target  system  state  with 
the  goal  of  reaching/maintaining  a  state  desired  by  the  controller.  Thus,  a  decision,  even 
if  correct,  does  not  lead  to  control  unless  it  is  followed  by  an  action  affecting  the  state  of 
the  target  system.  As  follows,  the  purpose  of  control  (and  thus  action)  is  to  either 
change  or  maintain  a  state  in  the  target  system. 

11.4  Discussion  -  Cognitive  Control  Tools 

So,  what  is  it  really  an  IDSS  and  what  is  supported  by  it?  It  seems  clear,  both  from  the 
descriptions  of  IDSS  in  the  proceedings  from  the  1985  meeting  and  actual  systems 
today,  that  such  systems  actually  “supports”  a  range  of  activities.  Decision  making  is 
only  a  part  of  the  cognitive  functions  involved  in  the  control  process,  which  in  its  most 
basic  form  can  be  described  as  monitoring,  detection,  evaluation,  decision  and  action. 
The  underlying  assumption  with  IDSS  seems  to  be  that  if  we  can  support  a  decision,  we 
will  also  enhance  control  and  performance.  If  that  is  the  point,  it  would  be  more 
justified  to  say  that  we  support  control  rather  than  decisions. 

However,  the  term  “support  system”  is  problematic  in  another  way  as  well  since  support 
can  be  performed  at  a  number  of  levels  (see  Dekker  &  Woods,  1999,  above).  If  we  take 
a  stance  in  the  ten  levels,  we  can  see  that  a  decision  support  can  be  practically  anything 
from  pen  and  paper  where  to-do  notes  are  made  to  a  fully  automated  control  system. 
What  seems  more  appropriate  is  to  firstly  find  a  term  that  describes  the  fact  that  the 
support  is  manifested  in  the  form  of  a  man-made  artefact  specifically  designed  with  the 
purpose  of  increasing  control.  A  term  that  is  commonly  used  is  tool.  The  term  tool 
indicates  that  we  are  discussing  an  artefact  that  is  adding  something  to  the  unaided 
capability  of  the  human  operator.  It  also  suggests  that  what  is  added  is  designed  for  a 
specific  task,  and  that  there  is  a  difference  between  performing  the  task  with  or  without 
the  artefact.  Further,  it  avoids  some  confusion  associated  with  the  use  of  “system”. 
When,  as  for  example  in  Cognitive  Systems  Engineering  (Hollnagel  &  Woods,  2005), 
an  operator  and  the  tools  he/she  is  using  is  viewed  as  a  cognitive  system,  the  status  of  an 
“Intelligent  Decision  Support  System”  is  somewhat  unfortunate,  since  it  suggests  that 
there  is  a  intelligent,  or  cognitive,  system  in  the  system,  thus  ascribing  cognition  or 
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intelligence  to  the  technical  system  in  it  self4,  while  the  actual  foci  should  be  on  the 
human  and  the  system  as  a  joint  cognitive  system  (Hollnagel  &  Woods,  2005). 

The  term  “intelligent”  used  in  combination  with  decision  support  seems  to  have  been 
problematic  already  at  the  1985  meeting  since  most  contributions  to  the  proceedings 
either  avoid  it  or  admit  that  they  lack  a  satisfying  definition,  and  the  confusion 
associated  with  the  term  has  already  been  discussed  above.  However,  we  can  conclude 
that  what  we  want  to  improve  is  a  cognitive  task  with  the  goal  of  controlling  a  target 
process.  Such  a  task  involves  both  higher  and  lower  levels  of  cognition,  like  monitoring, 
detection,  decision-making  and  planning.  We  therefore  suggest  the  following  re¬ 
formulation  of  IDSS;  “intelligent”  should  be  replaced  by  cognitive,  “decision”  should 
be  replaced  by  control,  and  finally,  “support  system”  should  be  replaced  by  tool,  ending 
up  with  the  term  Cognitive  Control  Tool,  (CoCoTo). 

A  Cognitive  Control  Tool  is  more  than  a  suggestion  for  a  re-definition  of  the  term  IDSS. 
The  way  it  is  defined  actually  allows  us  to  derive  some  (very  general)  guidelines  for 
design  of  such  a  system: 

First  of  all,  it  is  a  cognitive  tool,  meaning  that  the  tool  should  be  used  for 
improving/amplifying  one  or  more  basic  cognitive  tasks.  A  model  of  cognition  and 
control  should  thus  be  used  as  a  point  of  departure.  In  this  case  many  different  models 
of  cognition  and  control  could  be  used  for  identifying  the  task,  as  long  as  the  model 
incorporates  the  basic  cognitive  components  of  control  (monitoring,  detection, 
evaluation,  decision  and  planning). 

Secondly,  the  specific  control  activity/process  that  the  tool  is  intended  for  has  to  be 
understood.  Is  the  usage  of  the  tool  mainly  induced  by  changes  in  the 
environment/target  process  (a  reactive  task,  focusing  on  regulation),  or  is  it  a  task  that  is 
mainly  induced  by  the  controller  (a  planning  task,  focusing  on  strategies/tactics),  or 
perhaps  both? 

Thirdly,  the  specific  setting  (context)  of  use  has  to  be  understood,  just  like  in  the  design 
of  any  tool.  The  working  context  generally  incorporates  some  specific  characteristics 
that  can  only  be  understood  by  studying  the  physical  work  space  and  the  specific 
behaviours  of  the  operators  working  in  that  setting. 

Labelling  the  area  of  interest  as  Cognitive  Control  Tools  will  not  solve  any  of  the 
problems  that  earlier  research  on  Intelligent  Decision  Support  Systems  has  encountered, 
but  it  might  help  us  avoid  some  of  the  confusion  that  is  associated  with  the  earlier  term. 
The  field  concerned  with  creating  tools  designed  to  improve  performance  in  cognitive 
tasks  like  monitoring  and  decision  making  have  always  been  multi-disciplinary  by 
necessity,  but  the  diverse  points  of  departure  (psychology,  computer  science,  HMI, 
cybernetics  etc)  have  lead  to  problems  in  agreeing  on  both  the  purpose  of  such  systems 


4  A  technical  system  can  be  seen  as  a  cognitive  system  depending  on  the  definition  of  cognition  that  is 
used.  This  is  however  not  appropriate  when  it  concerns  tools  meant  to  be  used  by  humans,  since 
they  then  should  be  incorporated  in  the  analysis  of  the  joint  system. 
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and  how  they  should  be  designed.  By  using  a  more  clear  terminology,  that  takes  a 
stance  in  the  development  of  tools  that  can  be  used  for  cognitive  control  tasks,  there  are 
at  least  a  chance  to  reach  a  consensus  about  what  we  discuss,  which  may  enhance 
collaboration  over  the  fields. 
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12.  KRAEMER,  SARA  &  CARAYON,  PASCALE:  INFORMATION 
DECISION  SUPPORT  SYSTEMS  IN  COMPUTER  AND  INFORMATION 
SECURITY 

Over  the  past  several  decades,  computer  and  information  security  (CIS)  and  its  related 
problems,  such  as  the  security  breaches,  attacks,  and  incidents,  have  adversely  affected 
business,  commerce,  and  the  nature  of  work.  The  2005  Computer  Security 
Institute/Federal  Bureau  of  Investigation  (CSI/FBI)  reports  data  from  699  respondents 
from  U.S.  corporations,  government  agencies,  financial  institutions,  medical  institutions 
and  universities  (Gordon,  Loeb,  Lucyshyn,  &  Richardson,  2005).  Some  $130  million 
dollars  were  accounted  for  total  losses  from  computer  security  incidents  (Gordon  et  ah, 
2005).  The  survey  found  the  following  trends  in  CIS:  (1)  56%  of  organizations  reported 
unauthorized  use  of  computer  systems  in  the  last  12  months;  (2)  9%  reported 
experiencing  more  than  ten  computer  security  incidents  in  the  past  year;  and  (3)  95% 
experienced  ten  or  more  Web  site  incidents  in  the  past  year  (Gordon  et  ah,  2005). 

The  security  community  has  largely  focused  on  the  technical  causes  of  security  breaches 
or  vulnerabilities.  It  has  been  argued  that  the  human  factor  that  is  associated  with  the 
use  and  design  of  security  is  largely  ignored  by  this  community  (Sasse,  Brostoff,  & 
Weirich,  2001).  The  poor  implementation  of  security  can  seriously  impact  an 
organization’s  productivity,  reputation,  and  the  well-being  of  its  employees.  The 
implication  is  that  while  human  side  of  computer  security  is  almost  always  exploited, 
such  as  a  user  error,  the  blame  is  not  of  the  users  but  rather  the  factors  of  the  work 
systems  in  which  they  work.  Even  with  a  strong,  technology-centered  approach,  many 
exploits  can  and  will  be  facilitated  by  user  behavior  (Besnard  &  Arief,  2004;  Carayon  & 
Kraemer,  2002;  Schein,  1984)  or  faulty  operational,  management,  or  organizational 
factors  (Computer  Science  and  Telecommunications  Board-National  Research  Council, 
2002). 

When  thinking  about  a  CIS  system,  end  users  and  network  administrators  or 
information  technology  professionals  differ  in  terms  of  their  needs  and  technical 
expertise  (Kraemer  &  Carayon,  2005).  End  users  may  have  minimal  direct  impact  on 
actual  or  potential  vulnerabilities  and  breaches  in  security.  Firewalls,  authentication 
systems,  and  access  levels  are  typically  set  up  to  prohibit  end  users  from  obtaining  root- 
level  access  and  inadvertently  causing  a  breach  in  security.  However,  end  users  may 
still  contribute  to  vulnerabilities  within  the  work  system.  For  example,  their 
noncompliance  with  security  policies  and  procedures  may  result  in  vulnerabilities, 
compromises,  and  breaches  of  security.  On  the  other  hand,  network  administrators  and 
other  information  technology  professionals  are  the  designers  and  implementers  of 
security  technologies  and  systems,  and  therefore  have  a  direct  impact  on  the  level  of 
protection  of  a  computer  and  information  system. 

12.1  Needs  of  various  computer  and  information  security  user  groups 

The  purpose  of  this  position  statement  is  to  outline  some  of  the  dimensions  of  needs  and 
possible  ‘outcomes’  for  various  groups  that  interact  with  computer  and  information 
systems  and  that  affect  their  security.  Our  second  purpose  is  to  highlight  possible 
applications  and  benefits  of  information  decision  support  systems  (IDSS)  in  CIS 
systems.  In  this  context,  we  have  identified  two  groups:  network  administrators,  those 
who  design,  build,  and  maintain  CIS  systems  and  end  users,  those  who  interface  with 
CIS  technology,  rules,  policies,  and  procedures  in  order  to  carry  out  their  work.  We 
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have  made  the  distinction  between  these  two  groups  because  of  their  varying  influence 
on  the  state  of  the  CIS  system:  a  network  administrator  has  the  ability  to  change,  edit, 
and  build  CIS  systems,  while  end  users  interact  with  the  technology,  policies,  and 
procedures  that  have  been  determined  by  the  network  administrators  and  other  system 
managers.  Some  possible  dimensions  of  the  various  interactions  between  a  user  and  a 
CIS  system  are  the  following: 

•  Attitude:  the  emotion  or  feeling  toward  CIS 

•  Behavior:  the  way  in  which  the  user  conducts  themselves  in  response  to  CIS 
initiatives,  programs,  technology,  policies,  other  users,  etc... 

•  Motivation:  reasons  for  user  behavior  toward  CIS 

•  Needs:  necessary  requisites  for  a  user  to  perform  their  work  and  maintain  proper 
security  levels 

It  is  important  to  consider  these  dimensions  because  there  are  various  workplace  factors 
that  affect  behavior,  and  therefore  different  mechanisms  to  support  network 
administrator  end  user  behavior.  In  order  to  examine  some  of  these  issues,  we 
interviewed  eight  network  administrators  at  two  computer  science  laboratories  at  a  large 
university  and  eight  security  managers  in  seven  private  industries  on  the  various  types 
of  human  error  in  CIS,  committed  by  both  network  administrators  and  end  users,  as  well 
as  the  various  workplace  factors  that  affect  the  occurrence  of  human  error  in  the  CIS 
context  (Kraemer  &  Carayon,  submitted  May  2005).  In  another  study  of  a  workgroup  of 
six  CIS  managers  and  specialists,  we  identified  eight  major  human  and  organizational 
factors  that  are  associated  with  specific  CIS  vulnerabilities  (Kraemer  &  Carayon, 
submitted  January  2005). 

In  these  efforts,  we  identified  human  and  organizational  factors  issues  that  are  different 
for  network  administrators  and  end  users.  For  example,  network  administrators  typically 
have  a  high  workload  that  prevents  them  from  adequately  monitoring  and  maintaining 
the  appropriate  patches  for  their  respective  CIS  systems.  Some  of  this  is  due  the  current 
state  of  CIS:  CIS  patches  are  not  systematized  into  one  central  location  or  method, 
network  administrators  have  to  search  websites  and  email  for  alerts,  or  rely  on  word  of 
mouth.  Coupled  with  a  high  workload  and  unruly  system  for  monitoring  and  applying 
patches,  many  times  vulnerabilities  are  missed  or  not  fully  applied.  For  end  users,  the 
challenges  are  different.  Since  their  principle  behaviors  center  on  the  interaction  with 
CIS  technology,  policies,  and  procedures,  the  usability  of  the  various  mechanisms  used 
to  support  CIS  becomes  an  issue.  Consequently,  the  end  user  may  adopt  a  series  of 
violations  or  ‘work  arounds’  in  their  tasks  and  work  efforts.  Despite  these  behaviors 
deviating  from  mandated  CIS  procedures,  their  actions  do  keep  certain  levels  of  CIS 
system  status.  Therefore,  there  are  opportunities  to  create  support  systems  for  network 
administrator  and  end  users. 

12.2  IDSS  in  computer  and  information  security 

There  are  some  possible  beneficial  applications  of  IDSS  in  CIS.  Research  in  the  area  of 
computer  and  information  security  is  young  and  underdeveloped,  and  are  not  to  the 
levels  of  sophistication  that  are  found  in  safety  in  aviation,  the  nuclear  power  industry, 
or  the  transportation  industry.  Some  possible  directions  for  the  development  of  IDSS 
and  CIS  are  the  development  of  tools  to  support  CIS  tasks  and  user  behavior.  In  order  to 
develop  these  areas,  we  have  conducted  some  preliminary  trade-off  analyses  to 
determine  the  benefits  and  challenges  faced  between  current  automated  or  simulation 
CIS  methods  and  human  performance  from  a  red  team  (Carayon  &  Kraemer,  2004).  We 
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have  collaborated  with  Sandia  National  Laboratories’  Information  Assurance  Red  Team 
(ID ART)  program  to  determine  a  set  of  trade  off  factors.  Red  teams  are  ‘hackers  for 
hire’  or  systems  security  analysts  that  are  hired  by  organizations  to  penetrate  their  CIS 
system  defenses,  break  into  their  systems,  and  provide  feedback  on  their  vulnerability 
state(s).  In  this  study,  we  conducted  semi-structured  interviews  with  15  red  team 
members  and  two  focus  groups  to  determine  the  tradeoffs  between  automated  or 
simulated  security  methods  versus  red  teaming.  The  interviewee  responses  are 
summarized  in  Table  1. 


Table  1.  Summary  of  responses  on  the  tradeoffs  between  automated  or  simulation  CIS 
methods  and  red  teaming  by  the  ID  ART  members 


Weaknesses  of  automated  or 
simulation  methods 

Strengths  of  automated 
or  simulation  methods 

Strengths  of  red  teaming 

-Humans  are  superior  at  connecting 
data  into  useful  information 
(7  comments) 

-Lacks  human  cognition  abilities 
(2  comments) 

-Lacks  social  engineering  abilities 
(2  comments) 

-Does  not  have  the  capabilities  to 
address  the  complexity  of  systems 
(2  comments) 

-Does  not  address  the  un 
predictability  of  computer  systems 
(1  comment) 

-Does  not  address  the  changing 
nature  CIS  (1  comment) 

-Lacks  the  ability  to  assess  the 
worst-case  scenario  for  the  system 
(1  comment) 

-Good  at  testing  a  set  of 
known  vulnerabilities  (3 
comments) 

-Useful  for  compiling  a 
database  of  red  team 
findings  (2  comments) 
-Useful  in  simple,  single¬ 
purpose  environments, 
such  as  isolated  sections 
of  an  information  system 
(1  comment) 

-Red  team  tactics  are  “ahead 
of  the  curve”  in  hacking  world 
(3  comments) 

-Red  team  methods  are 
creative  (3  comments) 

-Able  to  respond  dynamically 
to  changes  in  system  states 
(2  comments) 

-Produce  a  specified  system 
analysis  (2  comments) 

-Write  specific  tools  to  aid  in 
targeting  vulnerabilities 
(1  comment) 

-Able  to  find  patterns  in  data 
(1  comment) 

From  the  red  team  perspective,  there  are  possibilities  for  the  design  of  support  systems 
for  CIS.  A  red  team  assessment  of  a  CIS  system  particularly  useful  for  targeted 
assessments,  using  cutting-edge  technology,  and  benefiting  from  the  synergy  of  a  high- 
performing  team.  Their  assessments  are  characterized  as  creative,  specific,  and  dynamic 
-  and  almost  always  lead  to  better  and  more  thorough  assessments  than  an  automated  or 
simulated  method.  Given  these  tradeoffs,  it  appears  that  there  is  opportunity  to  glean  the 
capabilities  of  a  red  team  to  create  support  systems  for  CIS. 
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13.  LIND,  MORTEN:  A  CONTROL  AND  SYSTEMS  ENGINEERING 
PERSPECTIVE  ON  MEANS  END  ANALYSIS  OF  WORK  DOMAINS 

Abstract 

Work  domain  analysis  using  means-end  analysis  (MEA)  is  one  of  main  ideas  of 
Cognitive  Systems  Engineering  (CSE).  It  is  suggested  that  a  representation  of  the  work 
domain  by  means-end  concepts  is  a  suitable  basis  for  designing  the  information  content 
of  human  machine  interfaces  for  supervisory  control  (Rasmussen  and  Lind,  1981).  It 
has  been  one  of  the  aims  of  the  CSE  research  community  within  the  last  two  decades  to 
explore,  develop  and  demonstrate  this  idea.  Especially  Rasmussens  abstraction 
hierarchy  (AH)  has  been  used  (Rasmussen,  Pejtersen  and  Goodstein,  1994)  and  more 
formalized  modeling  approaches  like  multilevel  flow  modeling  (MFM)  has  been 
developed  (Lind,  1994  and  1999).  But  as  with  other  innovative  ideas,  the  idea  of  using 
means-end  concepts  for  human  machine  interface  design  is  based  on  several  claims  and 
assumptions.  Until  recently  only  little  attention  has  been  devoted  to  an  examination  of 
these  claims  and  assumptions.  In  the  paper  we  will  identify  some  of  the  claims  and 
assumptions  and  discuss  their  validity  from  the  perspective  of  control  and  systems 
engineering.  We  will  also  identify  some  of  the  challenges  facing  current  research  in  the 
area. 

13.1  Introduction 

We  will  discuss  the  following  two  claims,  which  we  believe  motivate  the  use  of  means- 
end  analysis  in  CSE. 

Means  end  concepts  and  analysis 

•  can  be  used  as  a  common  basis  for  design  of  the  human  machine  interface  and 
the  automation 

•  represents  the  constraints  of  the  work  domain  which  are  relevant  for  the 
operators  in  supervisory  control  tasks  and  does  it  independently  of  specific  fault 
situations 

It  is  also  claimed  that  means  end  concepts  have  cognitive  validity  by  reflecting  basic 
modes  of  human  understanding  of  the  intentional  structures  of  the  physical  and  social 
environments.  Presentation  of  information  based  on  these  concepts  in  the  interface 
would  therefore  be  intelligible  to  an  operator  and  thereby  contribute  to  making  the 
supervised  system  transparent.  The  relevance  of  means-end  concepts  for  human 
cognition  is  confirmed  by  the  work  of  Duncker  (1945),  Newell  and  Simons  research  in 
human  problem  solving  (Newell  and  Simon,  1972)  and  by  studies  of  fault  finding  by 
technicians  in  electronics  workshops. 

It  is  actually  the  combination  of  this  claim  with  the  other  claims  mentioned  above  that 
makes  CSE  an  attractive  framework  for  HMI  design.  However,  a  detailed  discussion  of 
the  relevance  of  means-end  concepts  for  human  problem  solving  is  outside  the  scope  of 
the  present  paper.  In  the  following  only  the  first  two  claims  mentioned  above  will  be 
discussed. 

13.2  The  Relevance  of  MEA  for  Systems  Design 

It  is  often  claimed  that  means-ends  analysis  of  the  work  domain  can  be  used  as  a  basis 
for  an  integrated  design  of  the  human  machine  interface  and  the  automated  systems. 
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One  of  the  problems  of  traditional  HMI  design  is  that  they  are  designed  too  late  in  the 
systems  design  process.  Factors  related  to  human  cognition  and  problem  solving  are 
therefore  not  taken  properly  into  account  in  the  design  of  the  automation  leading  to 
suboptimal  allocation  of  control  tasks  between  the  human  and  the  machine.  But  we  have 
found  that  work  domain  analysis  by  means-end  concepts  does  not  integrate  very  well 
neither  with  current  systems  design  processes  in  automation  industry  nor  with 
mainstream  concepts  of  control  theory. 

13.2.1  The  Systems  Design  Process 

Industrial  engineering  of  control  systems  is  based  on  diagrammatic  representation  of  the 
process  and  the  automation  system  in  the  form  of  process  flow  diagrams  depicting 
material  and  energy  flow  paths  and  process  and  instrumentation  diagrams  showing 
relationships  between  process  components  and  the  control  instrumentation.  The 
intended  behavior  of  the  control  systems  is  described  in  diagrams  depicting  the  control 
logic.  These  diagrams  are  used  as  a  basis  for  representation  of  decisions  in  the  design 
process  and  are  often  used  directly  as  templates  for  supervisory  displays.  Explicit 
information  about  relations  between  the  means  and  ends  of  the  physical  process  and  the 
control  systems  can  only  be  derived  with  difficulty  from  these  diagrams  and  only  with 
assistance  from  experts.  Industry  reuse  design  solutions  in  order  to  reduce  engineering 
costs  and  the  design  rationale  can  therefore  be  difficult  to  acquire  from  the  engineers 
and  must  therefore  often  be  inferred  from  other  sources  of  knowledge1. 

There  is  accordingly  a  serious  knowledge  acquisition  bottleneck  in  addition  to  the 
problem  of  translating  information  between  different  forms  of  representation.  There  is 
an  interest  in  automation  industry  to  improve  the  design  process  including  the 
documentation  but  the  risk  involved  in  changing  the  design  process  is  often  too  high. 

Currently  large  efforts  are  made  industry  to  develop  system  design  standards.  As  an 
example  can  be  mentioned  the  ISA  standard  S88  for  design  of  batch  control  systems. 
These  standards  aim  at  reducing  engineering  costs  and  ensuring  compatibility  between 
systems  solutions  from  different  vendors.  The  design  problems  at  the  human  machine 
interface  are  not  considered  and  it  is  not  clear  how  the  work  domain  analysis  of  CSE 
relate  to  the  models  proposed  in  the  standard. 

Research  studies  in  ecological  interfaces  based  on  the  AH  have  been  focused  on  a 
narrow  range  of  control  tasks  and  it  is  not  clear  to  what  extent  the  AH  can  cope  with  the 
diverse  types  of  tasks  involved  in  supervising  complex  industrial  plant.  They  typically 
involve  both  continuous  and  discrete  (e.g.  batch)  processes.  Recent  extensions  of  MFM 
include  the  possibility  to  represent  a  large  variety  of  control  tasks  also  comprising  safety 


1  A  related  problem  appears  in  the  field  of  systems  biology  where  researchers  try  to  understand  the 
regulatory  functions  of  microorganisms.  Here  there  is  no  blueprint  and  information  about 
regulatory  functions  (and  thereby  the  purposes  of  the  different  processes  involved)  must  be 
inferred.  Recent  research  indicate  that  MFM  may  be  used  to  model  the  biological  processes  on 
several  levels  of  functional  abstraction  in  order  to  obtain  an  overall  understanding  of  the  functional 
organization  of  microorganism  (Gemaey,  Lind  and  Jorgensen,  2004). 
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related  controls  (Lind,  2005).  However,  more  work  needs  to  be  done  in  order  to  ensure 
sufficient  coverage  of  MFM. 

There  is  therefore  little  hope  that  means  end  concepts  promoted  by  the  CSE  community 
will  be  accepted  as  a  basis  for  integrated  systems  design  unless  these  incompatibilities 
are  reduced  or  completely  eliminated. 

13.2.2  The  challenges  of  agent  technology 

Current  industrial  interest  in  applying  agent  technology  for  process  control  and 
supervision  may  on  a  longer  time  scale  contribute  to  a  resolution  of  the  incompatibility 
problem.  Advanced  types  of  software  agents  based  on  e.g.  the  BDI  (belief,  desire, 
intention)  architecture  are  designed  to  deliberate  about  means  and  ends,  to  negotiate  and 
to  cooperate  (Woolridge,  2000).  This  technology  is  claimed  to  be  suitable  for  the 
implementation  of  self-configuring  or  self-organizing  distributed  control  systems  and  is 
taken  seriously  in  current  developments  in  advanced  controls  for  power  networks  and  in 
holonic  manufacturing  systems.  Successful  application  of  agent  technology  will  require 
confidence  with  means-end  concepts  and  analysis  by  control  systems  designers  and 
therefore  possibly  also  change  the  control  systems  design  process  to  facilitate  integrated 
systems  design  as  proposed  by  the  CSE  community.  However,  agent  technology  can 
and  will  therefore  also  be  used  to  increase  the  level  of  automation  and  thereby  to 
increase  the  complexity  of  the  human  supervisors  task. 

13.3  The  problem  of  embedded  controls 

One  of  the  challenges  of  agent  based  control  systems  to  CSE  will  be  to  be  able  to  handle 
work  domains  with  embedded  control  systems.  This  problem  require  an  understanding 
of  how  the  levels  of  functional  abstraction  are  constituted  and  cuts  therefore  deeply  into 
the  foundations  of  means-end  analysis  (Lind,  2003  and  2004).  An  understanding  of  this 
modeling  problem  can  only  be  obtained  through  formalization  of  means  end  concepts. 

An  aim  of  MFM  research  is  to  establish  a  formalized  framework  for  means-end  analysis 
and  an  understanding  of  the  problem  of  embedded  control  is  now  emerging  (Lind, 

2005).  One  of  the  insights  obtained  from  recent  MFM  work  is  that  formalization  (and 
thereby  solution  of  the  problem  mentioned  above)  requires  that  model  concepts  should 
be  adapted  to  the  work  domains  (Lind,  2004).  MFM  is  therefore  now  seen  as  a 
modeling  language  that  is  targeted  towards  a  specific  but  still  very  comprehensive 
domain.  This  means  that  the  set  of  flow  functions  in  MFM  is  not  generic  but  a  set  that  is 
relevant  for  certain  types  of  application.  We  cannot  therefore  support  the  idea  of  using 
the  elementary  flow  functions  to  define  generic  building  blocks  for  HMI  design  as 
proposed  by  Liu,  Tanaka  and  Furuta  (2002). 

13.4  The  needs  for  formalization 

The  comparison  of  the  AH  and  MFM  made  by  Bums  and  Vicente  (2001)  seems  also  to 
miss  the  target.  They  suggest  that  the  two  modeling  frameworks  are  different  because 
MFM  is  goal  oriented  whereas  the  AH  is  structure  oriented.  The  comparison  seems  to 
ignore  the  most  significant  difference  which  is  in  the  levels  of  formalization  of  the  two 
approaches  to  means-end  analysis.  The  high  level  of  formalization  makes  MFM  suitable 
for  solving  the  problem  of  embedded  controls,  for  building  reasoning  systems  for 
decision  support  and  for  validating  the  consistency  of  control  systems  design  solutions 
whereas  the  low  level  of  formalization  of  the  AH  makes  it  open  to  interpretation  and 
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therefore  unfit  for  the  types  of  problem  addressed  by  MFM.  The  AH  may  be  easier  to 
apply  than  MFM  in  less  demanding  informal  design  processes  in  industry. 

13.4.1  The  Compatibility  of  ME  A  with  Control  theory 

Another  obstacle  towards  bringing  MEA  into  the  control  systems  design  process  is  the 
difficulty  in  connecting  means-end  analysis  with  concepts  of  mainstream  control  theory 
that,  in  the  end,  is  the  educational  background  of  most  control  engineers.  Within  this 
tradition  modeling  the  work  domain  would  mean  to  define  the  differential  equations  that 
govern  the  behavior  of  the  system.  These  models,  which  play  a  central  role  in  the 
solution  of  control  design  problems,  describe  the  dynamic  dependencies  between 
process  variables  representing  mechanical  and  thermodynamic  properties  of  both  the 
material  objects  transformed  in  the  process  and  the  plant  equipment.  In  contrast,  means 
end  analysis  is  anchored  in  common  sense  concepts  of  agency,  actions  and  objects.  In 
addition,  concepts  of  intention  and  purpose  play  a  central  role  in  MEA  whereas  these 
notions,  in  spite  of  their  obvious  importance  for  understanding  the  concept  of  control, 
have  no  explicit  representation  in  differential  equations.  This  apparent  incompatibility 
of  the  concepts  of  MEA  and  control  theory  makes  it  difficult  to  transfer  knowledge 
about  the  ends  and  means  of  the  automated  controls  to  the  HMI  designers.  They  require 
this  information  in  order  to  make  the  purposes  and  functions  of  the  automated  controls 
transparent  to  the  operator.  It  is  one  of  the  future  challenges  for  research  in  CSE  (or 
control  theory?)  to  develop  an  understanding  of  the  relation  between  these  two  ways  of 
conceptualizing  and  thereby  modeling  control  phenomena.  Recent  preliminary  studies 
by  Lind  (2004)  has  shown  that  means-end  concepts  play  a  crucial  role  in  framing  the 
modeling  problem  i.e.  they  are  active  in  the  so-called  pre-scientific  phase  of  problem 
setting.  However,  this  knowledge  is  rarely  documented  and  then  only  in  an  informal 
textual  form.  Formalized  means-end  analysis  of  the  design  control  design  problem 
would  make  this  knowledge  explicit.  A  deeper  understanding  of  the  relation  would 
therefore  be  a  valuable  contribution  to  modeling  methodology  and  would  also  enable  an 
effective  transfer  of  information  between  control  engineers  and  HMI  designers. 

13.5  Using  MEA  to  represent  work  domain  constraints 

The  present  difficulties  in  linking  MEA  concepts  firmly  with  concepts  of  control  theory 
raise  serious  uncertainty  concerning  the  validity  of  the  second  claim  on  our  list  -  that 
means-end  concepts  can  be  used  to  represent  the  physical  and  intentional  constraints  of 
the  work  domain  that  are  relevant  for  the  operator’s  supervisory  tasks.  It  is  therefore 
thought-  provoking  that  CSE  researchers  interested  in  ecological  interfaces  (Vicente, 
1999)  link  their  work  to  control  theoretical  modeling  concepts  (differential  equations 
representing  mass  and  energy  balances)  and  at  the  same  time  argue  for  value  of  means- 
end  concepts  for  representation  of  work  domain  constraints!  This  apparent  contradiction 
could  reflect  a  lack  of  consensus  on  MEA  concepts  in  the  CSE  community. 

13.5.1  Independence  on  specific  fault  situations 

It  is  also  claimed  that  means  end  concepts  makes  it  possible  to  make  representations  of 
the  work  domain  which  are  independent  on  specific  fault  situations.  It  is  argued  that 
means-end  concepts  produce  models  on  a  high  level  of  functional  abstraction  describing 
normal  behavior  of  the  system  under  control.  Fault  situations  would  in  such  a 
representation  appear  as  a  deviation  from  the  normal.  Means-end  models  can  therefore 
be  used  to  diagnose  unforeseen  events.  In  this  way  means-end  analysis  in  a  neat  way 


49 


IDIS  2005 


Lind 


circumvent  the  problem  of  approaches  based  on  modeling  fault  behavior.  Here  it  is 
necessary  to  consider  all  possible  faults,  a  task  which  in  most  interesting  cases  will 
require  much  effort  and  the  resulting  fault  models  will  suffer  from  completeness 
problems. 

Here  the  problem  is  that  we  need  to  be  more  careful  in  defining  what  we  mean 
by  a  situation.  This  means  that  the  claim  may  be  valid  for  certain  types  of  upsets  in  the 
system  so  that  the  relations  between  levels  of  functional  abstraction  actually  can  be  used 
to  identify  causes  and  consequences  of  a  failed  function  as  claimed.  But  what  search 
paths  should  be  followed  in  means-end  space  if  assumptions  that  ensure  the  validity  of 
the  levels  of  functional  abstraction  are  violated?  In  such  situations  it  would  probably  be 
necessary  to  search  for  causes  and  consequences  in  the  physical  structure  and  the 
means-end  analysis  would  not  be  of  much  value.  A  practical  way  of  addressing  this 
problem  could  be  to  combine  means-end  models  with  fault  models  in  order  to  ensure 
coverage  in  such  cases.  Paulsen  (2004)  considered  this  possibility  of  combining  results 
of  risk  analysis  with  MEA  in  display  design.  However,  a  more  fundamental  resolution 
of  the  problem  would  require  an  understanding  of  how  levels  of  function  are  constituted 
in  MEA.  The  same  research  challenge,  which  is  created  by  the  problem  of  embedded 
controls. 
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15.  MCDONALD,  NICK:  MAPPING  THE  SOCIAL  SPACE  OF  COMPLEX 
SYSTEMS 

Decision  making  can  be  seen  as  one  of  a  set  of  social  processes  through  which 
organisations  contact  their  operations.  In  order  to  understand  how  these  social  processes 
function  normally,  or  to  conceive  how  they  could  be  improved,  optimised  or  otherwise 
changed,  it  is  necessary  to  develop  as  far  as  possible  an  understanding  of  their 
operational  context  -  developing  a  rich  picture,  or  thick  description  of  the  whole  socio- 
technical  situation.  Such  description  needs  to  meet  a  number  of  requirements.  It  needs 
to  be 

•  Grounded:  addressing  the  normal  operational  activities  of  every  day  life, 
including  informal  and  unofficial  ways. 

•  Systemic:  seen  in  the  context  of  the  organisational  systems  and  processes  which 
constrain  and  influence  activity  -  a  functional  model. 

•  Dynamic:  Concerned  with  activity  over  time  and  processes  of  stability  and  change. 

•  Meaningful:  Encompassing  the  way  in  which  people  make  sense  of  understand 
their  activity  in  its  systemic  context. 

The  Knowledge  Space  Model  (KSM)  is  a  broad  methodological  approach  which  seeks 
to  fulfil  all  these  requirements  in  understanding  the  human  role  in  complex  systems.  It 
has  been  developed  in  the  context  of  the  design  of  new  technologies  and  processes  for 
aircraft  maintenance.  However  the  principles  can  be  adapted  to  other  operational 
situations  and  a  variety  of  social  processes. 

It  is  based  on  the  following  principles:- 

Mapping  the  relevant  operational  processes  -  this  gives  the  functional  requirements  and 
operational  sequence  of  that  process.  Such  process  maps  represent  a  sequence  of  stages 
rather  than  an  account  of  all  the  activities  that  energise  such  processes. 

Gathering  accounts  of  actual  occurrences  around  these  processes.  Narratives  can  come 
from  different  sources  (events,  audits,  anecdotes,  other  analyses).  Such  narratives 
preserve  the  sequence  of  activity,  they  allow  interpretation  of  intentionality  and 
causality,  they  structure  the  activity  in  terms  of  the  actors,  the  context  and  the  outcomes, 
and  enable  an  ongoing  evaluation  of  this  activity  as  well  as  drawing  conclusions 

Designing  prototypical  narratives,  which  are  general  accounts  of  what  typically  happens 
around  the  operational  processes. 

Mapping  social  processes.  All  evidence  is  used  to  construct  a  systematic  model  of  the 
social  processes  which  underlie  the  normative  patterns  of  activity  included  in  the 
narratives  (these  are  not  just  at  the  ‘sharp-end’  but  extend  across  the  whole  process 
space).  These  accounts  can  be  constructed  at  different  levels. 

Devising  requirements  to  optimise  process  functioning,  for  example,  information 
requirements  or  competence  requirements. 

Devising  requirements  for  future  systems.  This  methodology  is  currently  being 
developed.  Ingredients  of  this  activity  include  the  capturing  of  tacit  knowledge  in 
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narratives  as  well  as  the  active  participation  of  relevant  technical  /operational 
experience  in  ‘knowledge  transformation  workshops’. 

This  approach  stands  in  contrast  to  conventional  HF  approaches  to  operational  systems, 
in  which  human  activity  is  presented  in  an  atomised,  de-contextualised  manner,  and  in 
which  Human  Factors  is  rarely  more  than  an  evaluation  activity  for  already-produced 
new  systems.  It  also  challenges  social-constructionist  accounts  of  organisational 
functioning,  which  do  not  adequately  address  the  social-technical  nexus  and  the 
possibilities  of  change.  The  KSM  methodology  is  intended  to  support  the  development 
of  future  systems  which  more  clearly  meet  human  operational  requirements  and  to 
provide  a  more  precise  understanding  of  the  requirements  for  organisational  and  process 
change. 
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16.  MAY,  MICHAEL:  ABSTRACTION  AND  REPRESENTATION 
16.1  Outline  of  the  argument 

Since  this  is  an  extended  position  statement  and  not  a  finished  paper,  I  will  briefly 
outline  the  basic  argument  as  it  fits  in  with  the  reunion/workshop  on  Intelligent  decision 
support  in  process  environments. 

The  position  paper  attempts  to  present  a  systematic  and  analytical  approach  to  the 
multimedia  multimodal  design  space  of  interfaces  in  the  context  of  support  for  tailoring 
in  supervisory  control.  The  approach  is  based  on  logical  semiotics  (i.e.  the  theory  of 
signs  and  signification  originating  with  C.S.  Peirce),  on  modem  cognitive  semantics  (G. 
Lakoff,  L.  Talmy,  G.  Fauconnier,  P.  Gardenfors  a.o.)  and  on  the  theory  of  scales  of 
measurement  (originating  with  S.S.  Stevens)  and  a  revision  of  its  use  within  the  theory 
of  distributed  representations  (J.  Zhang,  D.  Norman,  E.  Hutchins).  The  approach 
includes  a  feature-based  taxonomy  of  media  and  representational  forms  and  in  this  part 
the  theory  is  also  based  on  Formal  Concept  Analysis  (FCA)  (May,  to  appear).  The 
whole  approach  should  be  seen  in  the  context  of  joint  work  on  the  conceptual 
foundations  of  human-machine  interaction  in  supervisory  control  (including  the  further 
development  of  MFM)  being  carried  out  with  Johannes  Petersen  and  Morten  Lind  at 
0rsted,  DTU. 

The  link  back  to  the  workshop  at  San  Miniato  (IDSS  1985)  is  the  following.  We  claim 
that  it  could  be  beneficial  for  the  further  development  of  the  paradigm  of  Cognitive 
Systems  Engineering  (CSE)  to  go  back  to  its  foundation  in  the  1980-ies  (Rasmussen  & 
Lind  1981;  Norman  1982;  Woods  &  Hollnagel  1983,  Norman  1986;  Woods  &  Roth 
1988)  in  order  to  reconsider  the  foundation  from  present  theoretical  accounts  (of 
distribution,  scaling,  property  spaces,  formal  concepts,  cognitive  support  etc.)  and  track 
the  changes  that  occurred  with  the  introduction  of  the  “ecological”  paradigm,  i.e.  the 
turn  towards  Ecological  Interface  Design  (EID).  Although  this  “Gibsonian  turn”  of  CSE 
in  many  ways  represents  an  important  contribution  to  CSE,  it  also  involved  a  narrowing 
down  of  its  scope  (at  least  in  the  way  this  paradigm  have  been  interpreted  in  later 
practice)  -  and  the  approach  to  interface  and  “representation  design”  is  an  example  of 
this.  Similarly  we  should  go  behind  the  foundation  of  EID  (Vicente  &  Rasmussen  1990, 
Vicente  &  Rasmussen  1992)  and  reconsider  its  foundation  (for  instance  in  the  concept 
of  “affordances”,  which  does  not  originate  with  Gibson  but  with  the  “topological 
psychology”  of  Kurt  Lewin  in  the  1940-ies). 

The  point  of  going  back  to  the  sources  of  the  CSE  and  EID  is,  among  other  things,  to 
make  the  implicit  semiotic  assumptions  explicit  so  that  they  can  be  evaluated  and 
restated  in  a  coherent  form.  This  “implicit  semiotics”  can  be  found  in  many  core 
writings  within  the  CSE  paradigm  (Rasmussen  &  Lind  1981;  Rasmussen  1983;  Woods 
&  Roth  1988)  in  the  form  of  assumptions  about  “signs”,  “signals”,  “representations”, 
“descriptive”  versus  “depictive”  representational  forms  etc.  The  attempt  to  articulate 
CSE,  and  more  specifically  the  multilevel  flow  models  (MFM)  in  the  context  of  process 
control,  with  an  explicit  semantic  and  semiotic  structure  has  primarily  been  undertaken 
by  the  Automation  group  at  0rsted-DTU  (Lind  1999a,  Petersen  2000;  Lind  2001;  Lind 
2003). 
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16.2  The  “gulf  of  design”  in  constraining  the  design  space 

Direct  manipulation  interfaces  (originally  proposed  by  Sneiderman)  have  been  seen  as  a 
solution  to  the  “gulf  of  execution”  problem  (Norman  1986),  and  Ecological  Interface 
Design  (EID)  (Rasmussen  &  Vicente)  have  been  seen  as  a  further  specification  of  this 
solution  for  complex  work  domains.  There  is  however  still  a  “gulf  of  design”  in 
bridging  domain  abstractions  and  interface  representations.  The  gulf  of  design  is  the 
problem  of  how  to  constrain  the  design  space  of  multimedia  multimodal  interface 
components  in  supporting  complex  work  activities  through  adaptation  and/or  tailoring. 

The  idea  of  “direct  perception”  of  affordances  does  not  help  designers  in  deciding  on 
the  form  of  representation  (in  the  sense  explained  below)  for  particular  types  of 
information  that  needs  to  be  exchanged  through  the  interface  of  a  Human-Machine 
System.  EID  claims  to  have  solved  this  problem,  at  least  partially,  but  it  only  appears  to 
be  the  case  because  EID  focuses  on  particular  types  of  information  content,  i.e. 
constraints,  and  particular  choices  of  expression  of  this  content  (graphs  and  “configural” 
displays)  based  on  information  integration.  Although  they  are  important,  graphs  and 
“configural”  displays  are  only  a  part  of  the  design  space  relevant  for  Human-Machine 
Systems. 

A  systematic  understanding  of  the  design  space  is  necessary  in  designing  for  safety  in 
complex  work  domains,  whether  the  strategy  of  design  is  to  develop  “smart”  adaptive 
interfaces  or  to  support  tailoring  by  the  operators  in  unforeseen  situations  (Petersen  & 
May,  to  appear). 

16.3  The  example  of  “configural  displays” 

Configural  displays  (mapping  several  variables  to  an  integrated  geometric  form)  have 
been  found  to  be  more  effective  in  supporting  tasks  than  pure  symbolic  “digital 
displays”,  but  “composite  displays”  using  multiple  forms  of  representation  was  found  to 
be  even  more  effective  (Bennett  &  Walters  2001).  In  fact  the  authors  warn  against 
concluding  that  configural  displays  are  somehow  optimal  designs,  and  points  out  that 
the  “coding  conventions  associated  with  each  individual  variable”  must  be  considered 
since  these  need  to  be  related  unambiguously  to  represented  system  states.  It  is  not 
enough  that  information  can  be  obtained  easily  from  the  graphics,  it  “must  also  be 
semantically  meaningful  in  the  context  of  the  domain  task(s)  to  be  performed”  (Bennett 
&  Walters  2001). 

There  is  a  semantic  problem  in  discussing  “configural  displays”  in  that  some  of  these 
displays  for  representing  multivariate  data  are  in  fact  graphs  with  an  unambiguous 
relation  to  represented  system  states  (for  example  the  Carnot  cycles  and  Rankine  cycles 
used  in  thermodynamics,  or  the  Smith  charts  used  in  electrical  engineering),  whereas 
others  (like  Chemoff  faces  or  the  “time  tunnels”  suggested  at  RIS0)  tend  to  be 
“desymbolized”  as  images,  i.e.  their  interpretation  will  tend  to  rely  only  on  properties  of 
images  (like  shape,  size  etc.)  rather  than  on  the  relational  properties  of  graphs.  The  two 
representational  forms  are  not  clearly  distinguish  by  EID  as  seen  in  the  following 
description  of  configural  displays:  “The  shape  may  be  a  commonly  familiar  shape,  such 
as  in  the  polygon  graphics,  or  it  may  be  a  shape  that  is  meaningful  to  the  particular 
process,  as  in  the  rankine  cycle  graphic.”  (Bums  &  Hajdukiewicz  2004,  p.  68).  Below  a 
figure  to  illustrate  the  process  of  desymbolization  as  a  transformation  of 
representational  form  (“sign  type”)  (May,  to  appear). 
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The  criticism  here  is  not  directed  at  configural  displays  as  such,  but  at  the  potential 
confusion  of  image-based  and  graph-based  properties.  In  many  cases  they  have  proved 
to  be  efficient  in  supporting  complex  monitoring  tasks,  and  there  are  for  instance  many 
applications  of  Rankine-like  graphs  in  domains  as  diverse  as  anaesthesia  and  nuclear 
power  plant  control. 

16.4  The  danger  of  reductionism  inherent  in  EID 

There  is  a  tendency  in  EID  towards  conceptual  reduction  of  representation  in  at  least 
two  different  ways.  This  inherent  danger  of  disregarding  representational  issues  is  of 
cause  paradoxical  since  EID  deals  with  “representation  design”,  but  never  the  less  it  can 
be  seen  clearly  in  discussions  of  the  relation  of  EID  to  ecological  psychology  (Vicente 
&  Rasmussen  1990). 

(1)  There  is  a  tendency  toward  a  reduction  of  the  semantic  choice  of  representational 
forms  to  the  problem  of  “conveying  affordances”  of  the  domain  making  them  available 
through  “direct  perception”  (and  with  the  exception  of  Sanderson  work  on  the  extension 
of  EID  to  auditory  displays,  this  is  furthermore  taken  to  mean  direct  visual  perception  of 
graphical  forms,  i.e.  excluding  acoustic,  gestic  and  haptic  media  for  presentation  of 
information). 

This  implies  a  kind  of  semantic  collapse  of  the  design  space  on  the  physical  description 
of  constraints  in  the  domain,  since  the  task  of  “conveying  affordances”  by  the  designer 
is  seen  as  “inverse  ecological  optics”  (sic!)  (Vicente  &  Rasmussen  1990).  This 
reduction  can  go  relatively  unnoticed  because  of  a  kind  of  default  assumption  in  EID 
(“In  general,  EID  would  advocate  the  use  of  a  configural  display”  ...  to  support  higher- 
order  properties  etc.,  as  described  by  Reising  &  Sanderson  2002),  but  at  the  same  time  it 
is  reported  that  higher-order  properties  could  in  fact  be  represented  effectively  in  other 
ways  (cf.  the  example  of  the  bar  graphs  discussed  by  Ham  &  Yoon  2001). 

From  the  point  of  view  presented  in  this  position  statement  there  are  in  fact  two 
dimensions  involved  at  the  expression  level  of  the  design  space:  the  cognitive  and 
semantic  properties  of  representational  forms  (image,  map,  graph,  diagram,  language, 
symbol)  and  the  added  properties  of  the  physical  media  (graphical,  acoustic,  gestic, 
haptic)  in  which  these  forms  are  expressed.  In  semiotics  the  abstract  representational 
forms  are  sometimes  called  “sign  types”  or  “forms  of  expression”,  whereas  their 
physical  realisation  (“presentation”)  in  a  media  is  called  the  “substance  of  expression”. 
Neither  form  nor  substance  of  expression  should  be  confused  with  the  specific 
communicated  content  (see  overview  diagram  at  the  end  of  this  position  paper)  or  with 
the  spatial  and  temporal  layout. 
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(2)  There  is  a  tendency  toward  a  reduction  of  the  syntactic  choice  of  spatio-temporal 
layout  to  the  problem  of  expressing  “the  relational  structure  of  the  domain”  (i.e. 
constraints),  since  it  is  claimed  that  “organizing  the  information  in  the  interface”  is 
directly  “equivalent  to”  (sic!)  determining  the  relations  between  affordances  of  the 
domain  (Vicente  &  Rasmussen  1990).  The  ideal  is  so  to  speak  that  the  domain  could 
“speak  for  itself’,  without  any  need  for  a  genuine  (semiotic)  articulation  of  the 
information  content  in  the  interface  or  any  further  (aesthetic  and  cognitive  ergonomic) 
layout  considerations. 

The  separation  of  expression  as  well  as  content  from  spatial  and  temporal  layout  is 
considered  an  important  progress  in  interface  design  within  multimedia  design  and 
information  presentation  (Bateman,  J.,  Kamps  T.,  Kleinz,  J.,  &  Reichenberger,  K. 
(2001);  Purchase  &  Naumann  2001;  May,  to  appear),  and  it  should  not  be  ignored  in  the 
context  of  human-machine  interaction  and  Cognitive  Systems  Engineering.  In  fact  the 
foundational  paper  on  EID  and  ecological  psychology  (Vicente  &  Rasmussen  1990) 
argues  for  an  analysis  of  “smart  instruments”  which  should  address  questions  about 
form,  content  and  structure,  but  unfortunately  the  content  is  only  understood  in  terms  of 
domain  content  (measured  properties)  and  not  in  terms  of  semantic  content  (of  the 
representation),  structure  is  only  understood  in  terms  of  relations  in  the  domain 
(constraints)  and  not  in  terms  of  “interfaces  structures”,  and  form  is  only  considered  as 
the  visual  forms  supporting  “direct  perception”  (the  configural  displays).  A  general 
understanding  of  the  relation  between  interfaces  and  domains,  such  as  the  relation 
between  interface  representations  and  domain  abstractions,  is  thus  excluded  from  EID 
because  of  the  conceptual  reduction  in  what  is  considered  as  “form,  content  and 
structure”. 

16.5  The  “language  of  interface  design” 

Methodologically  EID  will  usually  introduce  design  solutions  based  on  a  Work  Domain 
Analysis  (WDA)  and  the  principle  of  presenting  constraints  in  the  domain  for  direct 
perception  and  manipulation.  Sometimes  the  design  solution  is  backed  up  by  empirical 
evidence  indicating  that  it  is  more  efficient  that  an  existing  solution.  This  procedure 
does  however  not  exclude  that  there  could  be  a  whole  range  of  other  design  solutions 
that  would  support  operators  equally  well  or  even  better;  the  point  being  that  the  design 
solutions  of  EID  does  not  rest  on  an  analytical  understanding  of  the  design  space  as  a 
whole. 

Furthermore  the  methodology  of  WDA  is  insufficient  for  deciding  on  relevant  interface 
components,  since  it  does  not  include  a  task  analysis.  A  recent  example  is  the  sketch  for 
a  hypothetical  car  interface  generated  by  (Bums  &  Hajdukiewicz  2004)  to  illustrate  the 
use  of  WDA  in  design.  Besides  suggestions  for  relevant  displays  based  on  multivariate 
constraints  (such  as  a  display  to  show  the  remaining  “fuel  range”  in  km)  they  suggest 
presenting  graphs  of  energy-related  engine  information  to  drivers  (fuel  injection  rate, 
engine  pressure  as  a  function  of  engine  temperature,  and  exhaust  temperature),  although 
these  displays  would  certainly  be  irrelevant  for  ordinary  drivers  (not  trained  in  engine 
diagnostics).  At  the  same  time  other  relevant  displays  that  could  have  been  suggested 
from  an  EID  point  of  view  are  not  generated  (an  example  could  be  a  display  of  variable 
stopping  distance). 

Since  (Bums  &  Hajdukiewicz  2004)  does  in  fact  present  a  “language  of  interface 
design”  it  is  possible  to  evaluate  the  limitations  of  their  EID-based  conception  of  the 
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design  space.  For  some  reason  they  start  out  by  implicitly  excluding  acoustic,  gestic  as 
well  as  haptic  media  (display  &  input)  components  and  only  analyze  graphic  display 
components,  although  they  later  refer  to  the  work  of  (Sanderson  et.al.  2000)  as  an 
extension  of  EID  to  include  auditory  displays  and  sonification  of  information. 
Following  an  early  paper  by  David  Woods  on  representation  design  they  actually  refer 
to  semiotics  with  regard  to  the  overall  distinction  between  “propositional”  (i.e. 
language),  “iconic”  (in  the  narrow  HCI-sense  of  images  and  graphic  symbols)  and 
“analogical”  forms  (where  they  consider  maps  and  graphs,  but  disregard  the  important 
category  of  diagrams)  of  representation  and  communication. 

They  do  however  not  consider  the  semiotic  distinction  between  iconic  and  symbolic  in 
its  full  form  (originating  with  the  logical  semiotics  of  C.S.  Peirce),  where  we  find  a 
whole  range  of  representational  forms  between  the  image  (the  most  “concrete”  iconic 
form)  and  the  condensed  symbol  (the  most  “abstract”  symbolic  form).  Another 
important  aspect  of  the  relation  between  signs  and  the  “objects”  they  represent  (“the 
represented  world”  in  the  terminology  of  Palmer  1978)  is  the  indexical  relation,  which 
relate  signs  causally  to  their  objects  (which  means  that  indexicality  will  always  be 
involved  in  signs  of  higher-order  properties  derived  from  basic  measurements).  Below 
is  a  schematic  diagram  of  the  fundamental  representational  forms  with  a  coarse 
distinction  between  three  forms  (Purchase  &  Naumann  2001)  and  a  more  fine  grained 
distinction  between  six  forms  (May,  to  appear). 

"Diagrammatic”  forms  (Peirce) 
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Media  types,  scale  types  and  representational  forms 

As  implied  above  the  semiotic  theory  suggested  here,  as  an  extension  of  the  CSE 
paradigm,  involves  a  conceptual  distinction  between  the  representational  expression,  the 
communicated  content  and  the  spatio-temporal  structure  (“interface  structures”)  of  the 
“representing  world”  on  one  hand,  and  a  domain  content  of  the  “represented  world”  on 
the  other  hand. 

In  this  respect  there  is  already  a  CSE  triangle  implied  in  the  purely  representational 
problem  of  the  relations  between  sign  (expression  as  well  as  content)  and  world 
(domain  content  as  the  reference  of  the  sign).  Beyond  representation  and  world  (cf.  the 
CSE  triangle  of  Woods  &  Roth  1988),  the  agents  and  their  situated  and  distributed 
activity  make  up  a  more  complicated  setting  for  CSE.  In  the  present  paper  the  focus  is 
only  on  the  representational  issues. 

The  “sign  unit”  in  the  present  context  is  any  type  of  interface  component.  Interface 
components  will  often  have  a  dual  side:  one  side  will  display  information  to  an  operator 
and  another  side  will  make  some  control  actions  available  (as  an  affordance  in  EID 
terminology).  Although  we  have  specialised  “input  devices”  and  “interfaces”  (in  the 
restricted  sense  of  display  technologies)  the  general  concept  of  an  interface  component 
of  human-machine  interaction  will  have  a  display  as  well  as  a  control  aspect. 
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A  nice  example  is  the  traditional  engine  telegraph  on  the  ship  bridge.  The  traditional 
electromechanical  engine  telegraph  permits  a  (“remote”)  control  action  to  be  performed 
with  regard  to  ship  propulsion  by  communicating  a  desired  speed  category  (like  “Full 
Astern”)  to  the  engine  control  room,  but  it  also  displays  information  about  the  desired 
speed  to  agents  on  the  bridge  (the  position  of  the  handle  is  visible  from  any  location  on 
the  bridge,  and  one  engine  telegraph  can  be  reduced  to  a  repeater  device  of  another 
engine  telegraph,  i.e.  forced  to  follow  the  movement  of  the  engine  telegraph  “in 
command”).  The  desired  speed  is  both  controlled  and  displayed  along  two  different 
scales,  i.e.  on  an  ordinal  scale  (stop  <  slow  <  half  <  full  speed)  and  on  a  nominal  scale 
indicating  direction  (astern,  [neutral],  ahead),  and  these  two  scales  are  combined 
(corresponding  to  the  combination  of  two  types  of  information:  speed  category 
information  and  directional  information).  As  an  input  device  for  control  actions  it  is  a 
haptic  media  component  permitting  1 -dimensional  manual  input  on  the  specified  scales 
for  ordinal  speed  and  nominal  direction.  As  a  display  component  it  is  a  visually 
perceived  graphical  media  component  (and  temporally  it  supports  sequential 
manipulation  /  animation). 


Representational  form 


Media 


Graph  Diagram  Symbol  Graphic  Haptic 


Two  different  media  is  thus  utilised  by  the  component  (haptic  and  graphic)  as  its  media 
of  manipulation  and  media  of  expression  respectively,  but  it  also  involves  three 
representational  forms.  The  display  component  is  basically  a  graph  supported  by  a 
schematic  structure  that  we  could  call  a  scale  diagram  to  make  the  two  aligned  scales 
explicit  and  by  symbols  (as  scale  annotation).  The  engine  telegraph  is  a  graph  in  its 
representational  role  as  a  display  component  and  also  in  its  representational  role  as  an 
input  component  (input  device).  We  could  reformulate  these  interconnected 
representations  by  stating  that  the  graph  has  a  descriptive  role  (as  a  display  of 
information)  and  a  prescriptive  role  (as  an  input  device  for  control  actions).  From  a 
formal  point  of  view  the  electromechanical  device  is  similar  to  an  interface  component 
like  the  slide  bar  (which  is  also  a  graph  presented  graphically,  although  it  needs  a 
separate  input  device  for  manipulation),  but  they  are  different  from  a  human  factors 
point  of  view:  a  “soft  instrument”  component  does  not  embody  all  the  affordances  and 
display  qualities  of  the  electromechanical  device. 

In  the  general  case  interface  components  in  HCI  and  HMI  should  be  conceptualised  as 
multimedia  units,  cf.  also  (Nesbitt  2001).  There  is  no  special  reason  why  we  should  not 
allow  interface  components  to  utilize  several  media  (graphic,  acoustic,  gestic,  haptic)  at 
the  same  time  and  we  should  also  be  prepared  to  conceptualise  them  as  being 
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“multimodal”  with  regard  to  representational  forms  or  “sign  types”  (combining  image, 
map,  graph,  diagram,  language  and  symbol  types). 

In  fact  the  prototypical  artefacts  that  we  are  familiar  with  (like  the  engine  telegraph  on  a 
ship,  the  interactive  metro  map  in  a  subway  station,  or  the  enunciator  alarm  panel  in  a 
control  room)  are  almost  always  multimedia  multimodal  artefacts  combining  different 
media  of  manipulation  and  presentation  for  the  expression  of  multiple  forms  of 
representation. 

Even  though  we  often  think  about  the  familiar  (“pseudo-concrete”)  objects  as  simple, 
they  are  in  fact  conceptually  complex  objects  combining  many  semantic  properties 
inherited  from  abstract  representational  forms  and  “emergent  properties”are  added  by 
the  media  of  manipulation  and  expression.  That  is  why  traditional  classification 
schemes  for  graphical  design  and  multimedia  design  have  been  inconsistent  as  well  as 
incomplete  (May,  to  appear). 

A  graph  expressed  in  the  graphical  media  (what  we  usually  associate  with  graphs)  have 
some  core  semantic  properties  common  to  all  graphs  and  then  some  additional 
“emergent”  properties  that  derives  from  its  expression  in  the  graphical  media.  A  graph 
expressed  in  the  acoustic  media  (an  “auditory  graph”)  has  the  same  core  semantic 
properties,  but  have  other  “emergent”  properties  derived  from  the  acoustic  media.  A 
diagram  expressed  in  graphics  have  core  properties  that  are  different  from  those  of 
graphs,  but  they  are  the  same  core  properties  that  diagram  in  the  haptic  media  have 
(“tactile  diagrams”).  The  difference  between  graphs  and  diagrams  as  representational 
forms  is  constituted  by  the  semantic  core  properties  which  are  invariant  across 
transformations  of  media  (Stenning,  Inder,  &  Neilson  1995;  May,  to  appear). 

In  this  way  we  can  set  up  a  consistent  taxonomy  of  simple  types  of  interface 
components  through  the  free  combination  of  feature  structures  describing  the  properties 
of  media  (graphic,  acoustic,  gestic,  haptic)  and  the  properties  of  representational  forms 
(image,  map,  graph,  diagram,  language,  symbol  on  a  first  level  of  specification).  A  brief 
sketch  of  how  this  can  be  done  is  shown  in  the  next  section  on  the  formal  structure  of 
the  design  space. 

The  kind  of  design  space  which  emerges  from  this  construction  also  supports  the 
formation  of  complex  components  from  simple  components  and  it  is  therefore  very  well 
suited  to  analytically  describe  the  complex  but  familiar  (“prototypical”)  interface 
components  as  well  as  the  unfamiliar  but  possible  components  that  have  not  jet  been 
designed  or  fully  explored.  One  can,  in  other  words,  use  the  design  space  as  an 
exploratory  tool  to  investigate  and  understand  interface  components  and  their  semantic 
properties.  The  real  strength  however  of  this  conceptualization  is  the  potential  for 
describing  the  design  space  of  media  and  representational  forms  fully  integrated  with 
the  scale  types  and  scale  transformations  needed  for  flexible  information  presentation 
and  support  for  tailoring. 

A  few  examples  using  traditional  gauges  and  graph  displays  can  clarify  the  proposed 
conception  of  the  design  space  before  we  turn  to  a  sketch  of  its  formal  structure.  Below 
to  the  left  some  reading  is  given  on  a  traditional  “analogue”  dial  instrument  display  (for 
the  purpose  of  the  example  we  do  not  discuss  the  domain  content  here,  i.e.  what  the 
measurement  is  about).  A  transformation  of  this  instrument  is  shown  (it  could  occur  at 
“design  time”  or  at  “run  time”  through  tailoring)  turning  it  into  a  “digital”  display.  In 
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both  cases  the  measurement  data  is  given  on  (we  assume)  a  ratio  scale  and  it  is 
presented  on  a  ratio  scale  as  well,  so  the  mapping  from  measurement  data  to  the 
presentation  of  this  data  preserves  the  scale  type  (cf.  Zhang  1996;  Petersen  &  May,  to 
appear). 


□  □  □ 

l_l  l_l  U 


The  scale  type  itself  (ratio  scale)  is  not  changed  by  the  transformation  shown  (here  we 
are  in  disagreement  with  the  analysis  of  J.  Zhang),  but  the  explicit  graphical 
representation  of  it  (showing  min  at  “0”  and  max  at  “100”)  is  changed  by  the 
transformation,  since  it  is  implicit  in  the  digital  display.  The  representational  form 
however  is  changed  radically  however,  since  the  “analogue”  dial  instrument  is  basically 
a  graph  (the  pointer-dial  component  is  an  animated  graph,  although  its  explicit  graphical 
scale  has  to  be  annotated  by  symbols),  whereas  the  “propositional”  digital  display  uses 
numerical  symbols  (as  a  form  of  expression  they  are  interpreted  on  a  ratio  scale 
although  their  substance  of  expression  are  graphical  forms,  i.e.  image-like  shapes, 
which  is  the  level  at  which  Zhang  describes  numerical  symbols). 

Another  example  is  shown  below.  Here  the  dial  instrument  display  is  preserved  by  the 
transformation,  but  a  second  graphical  scale,  of  an  ordinal  scale  type  (displayed  through 
colour  coding  of  three  areas),  have  been  superimposed  on  the  first  graphical  scale.  This 
illustrates  superimposition  of  graphical  scales,  which  can  be  very  relevant  for  redesign 
and  tailoring  (Petersen  &  May,  to  appear). 


A  third  example  shows  a  transformation  of  representational  form  that  also  involves  a 
change  in  scale  type.  In  stead  of  superimposing  the  ordinal  scale,  we  could  substitute 
the  ratio  scale  of  the  dial  instrument  with  a  presentation  on  an  ordinal  scale.  This  scale 
substitution  will  change  the  layout  of  the  pointer-dial  component:  the  operator  will  now 
only  see  the  pointer  in  a  cell  position  and  not  as  pointing  to  an  exact  numerical  value, 
but  his  reduction  could  in  fact  have  a  higher  information  value  for  the  operator  under 
some  circumstances,  where  the  exact  value  is  irrelevant. 
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A  further  reduction  to  a  “weaker”  scale  (see  Petersen  &  May,  to  appear)  is  possible 
based  on  a  transformation  of  the  ordinal  scale  to  a  nominal  scale,  where  the  measured 
variable  is  simply  classified  as  being  “OK”  (within  the  desired  range)  or  not.  Here  the 
ordinal  information  is  lost  in  the  presentation  (this  corresponds  to  a  simple  alarm). 


An  alternative  to  the  indicator  light  on  the  nominal  scale  shown  above  would  of  cause 
be  having  an  auditory  alarm  triggered,  when  the  measured  variable  is  passing  beyond 
the  desired  range.  In  the  design  space  this  would  correspond  to  a  transformation  in  the 
media  type  from  graphical  to  acoustic  media  presentations.  The  graphical  indicator  light 
and  the  auditory  alarm  would  however  both  be  on  the  same  scale  (nominal  scale)  and 
both  have  the  same  representational  form  (symbol).  We  could  however  also  change  the 
representational  form  of  the  alarm  -  for  instance  if  we  wanted  to  have  a  spoken  warning 
or  alarm,  in  which  case  the  representational  form  is  transformed  from  symbol  to 
language. 

A  final  example  can  illustrate  a  transformation  within  a  representational  form  between 
subtypes.  Below  to  the  left  is  shown  the  dial  instrument  display  with  the  ratio  scale  and 
a  superimposed  ordinal  scale.  In  the  pointer-scale  component  the  temporal  dimension  of 
the  graph  is  implicit,  which  means  that  the  operator  -  if  knowledge  of  the  history  of  the 
measured  variable  is  important  for  the  task  -  has  to  construct  and  remember  this  history. 
This  will  of  cause  impose  an  added  workload  on  the  supervisory  control  tasks.  A 
transformation  within  the  graph  category  from  the  pointer-scale  component  to  a  history 
graph  will  make  the  temporal  dimension  explicit  by  adding  the  dimension  of  time.  The 
superimposed  ordinal  scale  will  here  be  shown  as  reference  lines  for  the  graph  on  the 
axis  of  measured  values. 


As  in  the  case  with  the  dial  instrument  display  we  could  also  have  a  scale  substitution 
within  the  history  graph  resulting  in  the  transformation  of  the  history  graph  to  the  left  to 
the  ordinal  history  graph  on  the  right,  where  exact  measurements  on  a  ratio  scale  is  lost 
in  the  presentation.  In  stead  there  is  a  focus  on  “time  blocks”  within  the  different  ordinal 
regions  that  might  give  important  information  to  the  operator. 
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The  theory  of  scale  types  (ratio,  interval,  ordinal  and  nominal)  and  distributed 
representations  is  introduced  in  (Zhang  1996)  and  the  theory  of  scale  transformations  as 
support  for  tailoring  is  introduced  in  (Petersen  &  May,  to  appear).  The  different  types  of 
transformations  and  operations  illustrated  (such  as  substitution  and  superimposition  of 
scale,  transformation  of  media  type,  and  transformation  of  representational  form)  can  all 
be  “pasted  together”  in  a  lattice-like  design  space,  which  could  also  account  for  the 
constructive  composition  of  complex  interface  components  (as  shown  for  the  engine 
telegraph  example,  but  without  the  scale  specifications). 

The  resulting  (very  large)  lattice  of  specifications  (upward  join  in  the  lattice)  and 
combinations  (downward  meet  in  the  lattice)  will  give  a  phenomenological  description 
of  the  complete  design  space  of  multimedia  multimodal  interface  components,  as 
opposed  to  an  analytical  description  of  the  properties  of  these  components.  The 
analytical  description  is  what  I  would  call  the  formal  structure  of  the  design  space. 

16.6  The  formal  structure  of  the  design  space 

The  taxonomy  of  the  media  and  representational  forms  suggested  here  was  sketched  in 
part  in  (May  2001a;  May  2001b;  May  &  Andersen  2001;  May,  to  appear).  It  relies  on  a 
set  of  fundamental  principles: 

•  There  are  a  limited  number  of  media  types  derived  from  sensory  modalities  and 
forms  of  communication  relevant  for  computer-based  interaction  (i.e.  graphic, 
acoustic,  gestic,  and  haptic) 

•  There  are  a  limited  number  of  possible  un-combined  representational  forms  (“sign 
types”) 

•  It  is  possible  to  give  a  feature-based  description  of  their  semantic  properties 

•  Some  of  these  properties  are  invariant  across  media  types  whereas  other  properties 
and  operational  possibilities  are  emergent  with  the  expression  of  signs  within  a 
media 

•  Invariant  properties  (the  “core”  semantics)  are  inherited  to  syntactic  combinations 
of  representational  forms  whereas  their  emergent  properties  are  constrained  by  the 
specific  combinations  of  media  types  and  representational  forms 

From  a  formal  point  of  view  the  feature  structure  approach  to  the  classification  of 
properties  correspond  to  setting  up  a  lattice  of  the  logical  combinations  of  features.  This 
approach  to  taxonomy  of  conceptual  structures  has  been  formalised  in  Formal  Concept 
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Analysis  (Ganter  &  Wille  1999),  where  features  (“attributes”)  and  the  concepts  they 
specify  (the  “objects”)  are  related  in  a  matrix  called  a  formal  context. 

A  formal  context  C:=  (G,  M,  I)  is  defined  as  two  sets  G  (from  German  “Gegenstande”, 
Objects)  and  M  (from  German  “Merkmale”,  attributes)  with  a  relation  I  between  G  and 
M.  The  elements  of  G  are  the  objects  and  the  elements  of  M  are  the  attributes  or  features 
of  the  context.  From  the  formal  context  all  possible  combinations  of  formal  concepts 
can  be  generated.  A  formal  concept  is  a  pair  (a,  b)  where  a  belongs  to  the  set  of  objects 
G  and  b  belongs  to  the  set  of  attributes  M.  To  construct  a  lattice  we  have  to  add  two 
points:  the  “top”  element  corresponding  to  the  empty  set  of  objects  and  the  union  of  all 
attributes  and  the  “bottom”  element  corresponding  to  the  full  list  of  objects  and  the 
empty  set  of  attributes. 

Consider  maps  and  network  charts  (a  particular  type  of  diagram)  as  two  different 
representational  forms.  We  can  express  what  this  difference  means,  in  terms  of  the 
semantic  features  and  supported  operations  associated  with  each  form  within  different 
media,  by  setting  up  the  formal  context  for  these  simple  objects.  The  following  example 
is  just  given  as  a  sketch  of  what  such  an  analysis  could  look  like  and  the  simplified 
formal  context  only  includes  the  following  five  objects  and  four  attributes  (semantic 
features  and  supported  operations).  The  attributes  of  the  example  are: 

•  Connectivity:  does  the  type  require  connectivity  to  be  preserved? 

•  Perceptual  logic:  does  the  type  support  “direct  perception”  of  logical  relations  in  a 
spatial  structure? 

•  Deformation:  does  the  type  support  (and  allow)  deformation? 

•  Object  localization:  does  the  type  support  localization  of  objects  relative  to  a 
“background”  reference  object  (not  just  localization  of  parts  within  a  whole)? 


Connectivity 

Perceptual  logic 

Deformation 

Object  localization 

Graphical  map 
(G-map) 

+ 

+ 

+ 

Haptic  map 
(H-map) 

+ 

+ 

Acoustic  map 
(A-map) 

+ 

Graphical  net 
(G-net) 

+ 

+ 

+ 

Haptic  net 
(H-net) 

+ 

+ 

Table  indicating  a  small  part  of  a  formal  context  specifying  the  map  and  the  network 
chart  types  expressed  in  different  media. 
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A  Hasse-diagram  of  the  lattice  corresponding  to  the  formal  concepts  specifying  maps 
and  network  charts  according  to  the  (simplified)  formal  context  sketched  above. 

It  is  implied  by  this  analysis  that  the  familiar  graphical  maps  -  although  they  are 
prototypical  maps  -  do  not  exemplify  the  core  semantics  of  maps.  It  is  in  fact  the 
apparently  peripheral  case  of  the  acoustic  map  (A-map)  that  exemplifies  the  core 
semantics  of  maps,  because  it  is  the  attributes  of  acoustic  maps  (in  the  example  here 
reduced  to  the  feature  “Object  localization”)  that  is  shared  by  all  maps.  Graphical  maps, 
of  cause,  also  have  this  feature,  but  in  addition  they  have  other  emergent  features 
derived  from  the  graphical  media  (Connectivity  and  Perceptual  logic). 

16.7  Preliminary  conclusion 

Since  this  is  intended  as  a  discussion  paper  there  is  no  conclusion  at  this  point,  but  the 
work  in  progress  presented  here  should  be  understood  in  the  context  of  joint  work  with 
Johannes  Petersen  and  Morten  Lind  (see  also  their  position  papers  for  IDSS  2005). 

Important  further  stages  of  the  work  in  progress  (the  part  of  it  presented  here)  will  be: 

Description  of  the  core  semantics  of  representational  forms  in  terms  of  their 
semantic  and  cognitive  properties. 

Concept  exploration  of  the  lattice  describing  the  design  space. 

-  Articulation  of  the  scale  theory  within  the  concept  lattice  describing  the  design 
space  (this  is  known  as  “scaling”  within  Formal  Concept  Analysis). 

Analysing  the  specific  cognitive  support  provided  by  different  choices  of  media  and 
representational  forms  for  the  expression  of  different  types  of  data  (whether 
measured  or  derived) 

Relating  the  semiotic  description  of  the  design  space  with  the  reconstruction  of  CSE 
and  MFM.  One  key  to  this  is  to  understand  the  description  of  media  types  and 
representational  forms  as  providing  an  ontology  of  signification.  Within  such  a 
framework  the  “abstraction  hierarchy”  should  be  understood  as  abstractions  over 
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domain  content  (Petersen  2004a)  corresponding  to  an  engineering  ontology  (among 
other  possible  engineering  ontologies  for  different  domains).  The  “three  layer 
model”  distinguishing  variables,  constraints  and  objects  &  relations  (Petersen 
2004a)  is  to  be  understood  as  providing  an  ontology  for  the  content  form  of 
interface  components  (see  Johannes  Petersens  position  statement). 

’’Representing  world”  ’’Represented  world” 


Representing  forms  & 
their  properties 

(Semiotics  &  cognitive 
science) 


Multimedia 

Unit 

(Interface 

component) 


Expression 


Content 


Form  of  expression 

(Syntax  and  semantics  of  Ontology  of 

representational  forms  )  signification 


Substance  of  expression 
(Property  dimensions  of 
the  media  of  expression ) 


r 


Ontology  of  the 
content  form 


Form  of  content 


r - 

I  Domain  (System,  control 

I  system,  work  domain ,  tasks 

&  activities) 


Ontology  of  the 
domain 


Substance  of  content 


Represented  content 

Domain  content 

Example: 

Example:  Purposes, 

Objects  &  relations , 

Abstract  fuctions,  etc. 

Constraints, 

(Abstraction  Hierarchy), 

Variables 

Engineering  ontologies 

The  schematic  diagram  above  gives  an  overview  of  important  representational  issues 
within  CSE  (not  CSE,  EID  or  WDA  as  a  whole)  based  on  the  semiotic  distinction 
(going  back  to  Hjelmslev)  between  Expression  and  Content  and  within  each  of  these 
between  Form  and  Substance.  The  sign  triangle  (Peirce’s  sign,  interpretant  and  object) 
in  this  model  can  be  seen  as  relating  a  physical  expression,  a  (representational)  content 
and  a  domain  content. 
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17.  MILLER,  ANNE:  TEMPORALITY:  THE  FORGOTTEN  DRIVER  IN 
HUMAN-SYSTEMS  INTERACTIONS 

We  get  up  in  the  morning;  we  go  about  social  and  productive  activities  interrupted  by 
the  need  or  desire  for  food,  and  at  some  point  we  go  to  bed  and  begin  the  cycle  again. 
The  temporal  organisation  of  human  activity  is  not  limited  to  daily  rhythms  but  extends 
to  weekly  and  annual  patterns  (Zerubavel,  1979).  Daily  and  annual  patterns  are  typically 
thought  to  have  an  ecological  basis;  they  represent  a  connection  between  human  activity 
and  events  occurring  in  the  environment;  the  effects  of  the  Earth’s  rotation  (daily 
pattern)  and  its  orbit  around  the  Sun  (seasonal  patterns).  Pre-industrial  human  activity 
and  society  adapted  to  temporality  in  the  natural  environment,  but  survival  and 
prosperity  was  vicarious. 

Industrial  production  methods  have  insulated  human  activity  from  environmental 
uncertainties  (Zuboff,  1984).  Over  time  the  relative  isolation  of  work  from  the  natural 
environment  has  shaped  the  way  we  as  researchers,  designers  and  analysts  conceptualise 
socio-technical  industrial  systems.  Our  generic  conceptualisations  of  socio-technical 
systems  are  reflected  in  the  dimensions  we  include  in  analytical  frameworks  such  as 
Work  Domain  Analysis  (Rasmussen  et  al  1994;  Vicente,  1999).  The  Work  Domain 
Analysis  framework  for  example  includes  two  conceptual  dimensions:  a  whole-part 
dimension  that  describes  a  system  in  terms  of  structural  relations  between  wholes  and 
parts  and  an  abstract  dimension  that  describes  a  system  in  terms  of  functional  relations. 

In  combination  these  dimensions  describe  a  socio-technical  system  according  to  ‘why, 
what,  how’  relationships.  Temporal  or  ‘when’  relations  are  not  included  in  these  types 
of  system  models  or  descriptions 

Over  the  last  30  years,  enterprises  including  utilities  such  as  power  production 
enterprises  (Memisevic  et  al,  2005)  have  become  relatively  more  open  to  environmental, 
social  and  economic  influences  which  like  natural  phenomena  have  different  levels  of 
periodicity  i.e.  daily,  weekly,  annual  periodic  cycles  (Zerubavel,  1979).  Current 
frameworks  for  modelling  complex  socio-technical  systems  do  not  accommodate 
temporal  dynamics  or  periodicities,  nor  do  we  have  coherent  theoretical  explanations 
about  human  behaviour  in  response  to  temporal  dynamics,  despite  that  temporality  is  an 
inherent  part  of  our  biological  and  social  make  up. 

Healthcare  has  always  been  a  substantially  open  system.  The  reason  for  a  hospital’s 
existence  is  to  provide  care  to  patients  as  and  when  patients  need  it.  Hence  the 
operations  and  the  services  a  hospital  provides  are  very  much  driven  by  the  population 
profile  (age,  incidence  and  prevalence  of  illness)  of  people  in  its  catchment  area.  The 
relative  incidences  of  illnesses  that  present  to  hospitals  have  probabilistic  temporal 
dimensions.  For  example,  in  a  particular  area  more  chest  infections  may  present  in 
autumn-winter  and  more  near-drowning  and  spinal  injuries  may  present  in  summer; 
trauma  from  motor  vehicle  accidents  is  higher  on  Friday  and  Saturday  nights  than  on 
Monday  and  Tuesday  nights  and  more  likely  to  occur  between  6  pm  and  mid-night  than 
between  6  am  and  mid-day.  We  know  very  little  about  how  staff  apprehend  these 
patterns  or  how  they  organise  their  work  collectively  and  individually  to  accommodate 
temporal  variation. 

As  more  enterprises  become  open  to  environmental  variability  we  will  need  to  move 
towards  a  more  socio-technical-information  systems  approach  that  accommodates 
temporality  characteristic  of  open  systems. 


71 


IDIS  2005 


Miller 


17.1  References 

Memisevic,  R.,  Sanderson,  P.,  Choudhury,  S.,  &  Wong,  W.  (2005).  Work  domain 
analysis  and  ecological  interface  design  for  hydropower  system  monitoring  and  control. 
Paper  accepted  for  publication  in  Proceedings  of  the  IEEE  International  Conference  on 
Systems,  Man,  and  Cybernetics.  Hawaii,  USA.  10-12  October.  [8  pp], 

Rasmussen,  J,  Pejtersen,  AM  &  Goodstein,  LP.  (1994)  Cognitive  systems  engineering. 
New  York,  NY:  John  Wiley  &  Sons 

Vicente,  K.  (1999)  Cognitive  Work  Analysis.  Mahwah,  NJ:  LEA 

Zerubavel,  E.  (1979)  Patterns  of  time  in  hospital  life:  a  sociological  perspective. 
Chicago,  Ill:  The  University  of  Chicago  Press 

Zuboff,  S.  (1988)  In  the  age  of  the  smart  machine:  the  future  of  work  and  power.  USA: 
Basic  Books 


72 


IDIS  2005 


Moray 


18.  MORAY,  NEVILLE:  THINKING  ABOUT  HELPING  DECISIONS 

If  we  are  interested  in  the  design  of  “decision  aids”,  it  may  help  to  think  about  the 
different  ways  in  which  people  make  decisions.  Perhaps  a  table  may  help. 


18.1  What  can  an  aid  do? 


Information 

available 

Complete  complex 
information 

Partial 

Information 

Perceptual 

Action 

available 

Many  complex 
options 

Help  to  remember 
possibilities,  what 
info  is  relevant  or 
available,  and 
what  actions  are 
available.  Help 
with  weightings. 
Suggest  “best” 
option. 

Make  sure  all 
available  info  is 
used,  and  remind 
about  what  is  not 
available.  Help 
with  weightings 

Suggest  “best” 
option 

Provide  “ecological 
display”  to  allow 
direct  perception  of 
location  in  state 
space,  and  relevant 
actions  to  state 

A  few  options 

Make  sure  all  are 
presented  and 
weightings  are 
appropriate 

Suggest  extra 
info,  warn  about 
missing 

alternatives  both 
for  info  and  action 

Show  as  patterns 

Simple  choice 

Map  complex  info 
onto  few  possible 
actions 

Map  info  onto 
actions 

Enhance  signal  to 
noise  ratio  and 
“optimize”  probability 
and  payoff  biases. 

As  we  move  toward  the  top  left,  the  role  of  decision  aiding  is  to  support  the  use  of  the 
maximum  amount  of  information  and  the  maximum  number  of  action  options.  As  we 
move  down  to  the  right  the  role  of  decision  aiding  is  to  enhance  the  detectability  and 
identification  of  the  signals  and  to  help  mapping  to  output,  in  both  cases  using  signal 
detection  theory  as  a  paradigm. 

Some  other  thoughts.  As  we  move  to  the  top  left  we  are  more  likely  to  be  in  the 
classical  decision  theory  area,  where  we  are  trying  to  optimize  or  satisfice  on  the  basis 
of  enumeration  of  possibilities,  followed  by  deductive  thought  to  choose  the  “best”  or 
the  local  best  (satisficing).  As  we  move  down  to  the  right  we  are  moving  towards 
recognition  based  decisions  where  the  identification  of  some  pattern  is  what  is 
important,  together  with  an  action  mapped  to  that  pattern  on  one-to-one. 

If  top  left  is  deductive  thought,  then  bottom  right  is  “intuitive”,  “habit”,  and  “strength  of 
belief’,  not  reasoning.  If  we  want  a  model  for  strength  of  belief  then  Evidence  Theory 
may  be  appropriate.  We  may  know  something  is  objectively  not  very  probable  but  be 
absolutely  convinced  it  is  going  to  happen. 

If  we  are  designing  decision  aids  for  the  top  left,  we  are  concerned  to  help  with 
deductive  reasoning,  identification  of  options,  weighting,  etc.  If  we  are  designing  for 
the  bottom  right,  decision  aids  should  enhance  SN  ratios,  filter  noise,  support 
unconscious  estimates  of  probability  and  payoffs.,  etc. 


73 


IDIS  2005 


Moray 


There  was  once  a  project  performed  by  Perceptronix  Inc  to  aid  decision  making  under 
pressure  in  which  pilot’s  decisions  were  recorded,  and  then  on  subsequent  occasions  he 
was  told,  “last  time  you  made  this  decision  you  decided  X”.  What  do  you  think  that 
was  supporting? 
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19.  NAIKAR,  NEELAM:  ENHANCING  DECISION  EFFECTIVENESS  WITH 
COGNITIVE  WORK  ANALYSIS:  THEORETICAL  AND  METHODOLOGICAL 
DEVELOPMENTS  IN  WORK  DOMAIN  ANALYSIS 

In  the  1985  Proceedings  of  the  NATO  Advanced  Study  Institute  on  Intelligent  Decision 
Support  in  Process  Environments,  Jens  Rasmussen  argued  for  the  importance  of 
designing  decision  support  systems  that  are  not  only  effective  during  stable,  routine 
conditions  but  also  during  situations  that  have  not  been  foreseen  by  designers  or  that  are 
not  familiar  to  professional,  trained  workers.  He  argued  that  in  order  to  develop  such 
systems,  design  cannot  be  based  on  detailed,  quantitative,  or  normative  prescriptions  of 
task  processes  or  sequences  but  instead  should  be  based  on  a  model  or  a  framework  that 
defines  the  boundaries  of  a  design  envelope  within  which  workers  can  generate  ad  hoc 
practices  that  not  only  suit  their  subjective  preferences  but  also  the  particular  demands 
of  the  situations  or  contingencies  at  hand.  His  paper  at  the  1985  workshop  focussed  on 
describing  such  a  framework;  a  framework  which  is  now  popularly  known  as  cognitive 
work  analysis. 

Since  the  1985  workshop,  cognitive  work  analysis  has  been  gaining  increasing  attention 
as  a  promising  approach  for  the  analysis,  design,  and  evaluation  of  complex 
sociotechnical  systems.  Researchers  have  explored  the  use  of  cognitive  work  analysis 
for:  designing  teams,  interfaces,  and  other  decision  support  systems,  evaluating  design 
proposals,  identifying  training  needs,  and  developing  specifications  (e.g.,  Bums,  2000; 
Dinadis  &  Vicente,  1999;  Gualtieri,  Elm,  Potter  &  Roth,  2001;  Linegang  &  Lintem, 
2003;  Rasmussen,  1998;  Vicente,  1992a, b;  Naikar,  Pearce,  Drumm  &  Sanderson,  2003; 
Naikar  &  Sanderson,  1999,  2001).  Moreover,  in  the  last  20  years,  cognitive  work 
analysis  has  been  researched  and  practiced  by  many  more  analysts  than  the  members  of 
the  original  team  who  developed  this  framework  at  the  RISO  National  Laboratory. 

One  interesting  and,  as  yet,  largely  unacknowledged  consequence  of  the  gaining 
popularity  of  cognitive  work  analysis  has  been  the  evolution  of  divergences  in  the 
theoretical  approaches  and  methodological  practices  of  different  analysts.  As  a  case  in 
point,  this  paper  will  examine  work  domain  analysis  -  the  first  and  most  commonly 
used  phase  of  cognitive  work  analysis.  The  most  comprehensive  accounts  of  work 
domain  analysis  to  date  are  provided  by  Rasmussen,  Pejtersen  &  Goodstein  (1994)  and 
Vicente  (1999).  While  these  texts  are  invaluable  resources  for  work  domain  analysis 
and  cognitive  work  analysis  in  general,  the  two  texts  appear  to  present  somewhat 
different  theoretical  approaches  to  work  domain  analysis.  For  example,  whereas  Vicente 
advocates  that  the  abstraction-decomposition  space,  which  is  the  main  modelling  tool 
for  work  domain  analysis,  should  not  contain  representations  of  activity,  many  of  the 
models  presented  by  Rasmussen  et  al.  seem  to  do  so.  Furthermore,  whereas  Vicente 
encourages  the  use  of  nouns  for  representing  constraints  in  the  abstraction- 
decomposition  space,  Rasmussen  et  al.  often  use  verbs  in  their  models.  Moreover, 
whereas  Rasmussen  has  indicated  that  he  now  believes  that  the  five  levels  of  abstraction 
that  are  commonly  included  in  an  abstraction-decomposition  space  are  conceptually 
necessary  and  sufficient  (in  Reising,  2000),  Vicente  argues  that  there  is  no  reason  to 
believe  that  the  same  five  levels  of  abstraction  will  be  relevant  to  all  work  systems  (also 
see  Lind,  2003). 

As  well  as  the  texts  by  Rasmussen  et  al.  (1994)  and  Vicente  (1999),  there  are  numerous 
other  publications  on  work  domain  analysis.  From  these  publications,  it  appears  that 
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there  is  also  some  variation  in  other  analysts’  approaches  to  work  domain  analysis.  For 
example,  analysts  seem  to  use  different  definitions  for  the  five  levels  of  abstraction  that 
are  commonly  included  in  the  abstraction-decomposition  space  as  well  as  different 
approaches  for  developing  the  decomposition  dimension  of  the  abstraction- 
decomposition  space.  These  variations  may  reflect  real  variations  in  the  work  systems 
that  were  studied  by  the  different  analysts.  However,  in  the  absence  of  explicit 
statements  by  the  analysts  to  confirm  this,  it  must  also  be  considered  that  the  variations 
may  reflect  the  lack  of  a  coherent  theoretical  and  methodological  approach  for  work 
domain  analysis. 

Without  a  coherent  theoretical  and  methodological  approach  for  work  domain  analysis, 
researchers  and  practitioners  may  find  it  challenging  to  develop  valid  models  of 
complex  work  domains.  Consequently,  our  ability  to  design  and  develop  safe,  effective, 
and  efficient  decision  support  systems  may  be  compromised.  This  paper  will  address 
some  of  the  theoretical  and  methodological  differences  that  have  emerged  in  the  area  of 
work  domain  analysis  and  propose  a  coherent  theoretical  and  methodological  approach 
for  this  phase  of  cognitive  work  analysis. 
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20.  NORROS,  LEENA:  DEVELOPING  ECOLOGICAL  DESIGN  OF  SMART 
ENVIRONMENTS 

Abstract:  The  smart  objects,  environments  and  infrastructures  of  the  knowledge  society 
should  meet  the  new  requirements  of  systems  usability.  This  claim  follows  from 
observations  that  ICT  is  a  more  universal  technology  than  any  previous  one  and  it  will 
shape  our  entire  living  and  working  environments.  However,  because  the  social 
dimension  is  not  sufficiently  well  integrated  with  the  technical  in  the  exploitation  of  the 
ICT,  its  potentials  are  not  effectively  and  appropriately  exploited.  Drawing  on  analysis 
of  the  particular  new  characteristics  of  ICT  technology  principles  for  an  ecological 
design  concept  are  derived.  These  principles  are:  1)  Adoption  of  a  monistic  approach  to 
human-environment  interaction;  2)  Focusing  on  the  dynamics  of  an  adaptive  human- 
environment  system  in  design;  3)  Understanding  usage  and  design  as  two  functions  in 
artefact  genesis;  4)  Developing  contextual  assessment  of  the  appropriateness  of  the 
design  outcome.  Each  of  these  principles  needs  to  be  theoretically  articulated,  and  new 
methods  for  research  and  design  should  be  developed.  The  four  principles  are  going  to 
be  elaborated  in  the  discussions  of  the  workshop. 

20.1  Introduction 

Information  and  communication  technology  (ICT)  will  have  profound  impacts  on  all 
spheres  of  life,  i.e.  in  everyday  life,  systems  of  production,  and  institutions  and  culture. 
New  challenges  for  human-technology  interaction  (HTI)  are  expected  particularly  in  the 
cross-sections  between  these  traditional  domains  (Tuomi  2001).  Traffic  and 
communication  systems,  agriculture,  or  wellbeing  industries  are  examples  of  new 
expanding  HTI  utilisation  areas. 

Technology  is  conceived  as  the  major  driving  force  for  economical  growth  and 
wellbeing  in  the  society.  Consequently,  much  effort  has  been  devoted  to  encourage 
technical  innovations.  Several  information  technology  roadmaps  identify  technologies 
that  may  affect  HTI  and  user  interfaces  (Norros  et  al  2003,  Plomp  et  al  2002,  Venta 
2005).  The  future  ICT  is  foreseen  to  enable  a  combination  of  high  level  of  user  mobility 
and  embedded  technology.  Multimodal  user  interface  technologies  will  become 
available. 

Critical  analyses  indicate,  however,  that  neglecting  the  user  in  the  design  may  create  a 
bottleneck  in  the  development  of  the  knowledge  society.  The  technology-push  view  is 
becoming  balanced  by  views  that  stress  equal  role  of  social  innovations  in  the 
development  of  the  knowledge  society  (Naumanen  2004,  Norros  et  al  2005).  It  is 
necessary  that  the  rational  relationship  to  nature  that  becomes  manifest  in  scientific 
knowledge  would  be  completed  by  a  rational  practical  relationship  to  nature.  Such  an 
attitude  protects  us  from  technological  hubris  in  our  attempts  to  control  the  laws  of 
nature  by  offering  a  possibility  to  reflect  the  long-term  effects  of  technology  on  the 
quality  of  the  human  life  and  the  living  environment  (Von  Wright  1998). 

20.2  ICT  is  a  universal  technology  with  instrumental,  cognitive  and 
communicative  functions 

Compared  to  any  earlier  technology  information  and  communication  technology  (ICT) 
is  a  far  more  general  and  even  universal  technology  that  has  practically  no  alternatives. 
As  such  ICT  not  only  changes  concrete  activities  but  revolutionises  the  societal  activity 
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structure  as  a  whole  and  the  complete  relations  of  activity  and  consciousness  (Ruckriem 
2003).  Hence,  when  we  study  the  usage  of  ICT  it  is  necessary  to  consider  it  both  as  a 
tool  of  making  and  as  a  medium  of  making  sense.  Hence  a  comprehensive  analysis  of 
ICT  considers  the  tools  and  media  in  their  instrumental,  cognitive  and  communicative 
functions. 

We  made  use  of  the  above  distinction  between  the  roles  of  ICT  when  considering  the 
future  HTI  research  issues  in  VTT  roadmap  work  (Norros  et  al  2003).  In  this  connection 
we  found,  however,  that  because  these  functions  of  technology  are  typically  tackled 
within  different  research  traditions,  new  theoretical  challenges  emerge  when  aiming  at 
their  holistic  understanding.  The  relationships  between  theories  of  human  action  and 
activity,  on  the  one  hand,  and  media  theories,  on  the  other,  need  to  be  revisited  and  their 
mutual  connections  analysed.  It  has  been  proposed  that  systems  theory  would  offer 
some  help  in  bridging  the  gaps  between  theories  and  in  improving  understanding  of  the 
generic  cultural  impetus  of  ICT.  In  the  forthcoming  workshop  my  I  shall  discuss 
research  and  design  approaches  that  could  promote  such  a  deeply  rational  and  human- 
centred  development  of  technology. 

20.3  An  ecological  methodology  to  guide  research  and  design  of  smart  objects  and 
environments 

Human-Technology  Interaction  research  has  traditionally  focused  on  the  analysis  of 
single  tools.  This  claim  applies  to  both  major  traditions  of  HTI,  i.e.  ergonomics  and 
human  factors  research  that  mainly  focuses  on  complex  industrial  work,  and  the  human- 
computer  interaction  research  that  originated  in  office  work  but  currently  flourishes  in 
the  usability  analysis  of  consumer  appliances.  At  the  same  time  as  ICT  technology  has 
brought  the  target  domains  and  research  issues  of  these  two  research  traditions  closer  to 
each  other,  we  may  also  identify  a  further  trend.  By  enabling  mobility,  embedded 
solutions  and  new  user  interfaces,  ICT  is  transforming  work  and  everyday  living 
environments  in  a  comprehensive  sense.  It  becomes  evident  that  human  action  does  not 
deal  with  interaction  with  separate  objects  (human-computer  interaction)  but  rather  with 
the  ICT-supported  smart  environment  as  a  whole.  Diverse  labels  have  been  used  for  this 
embedding  of  ICT  in  the  environment,  e.g.  ubiquitous  or  pervasive  computing. 
Consequently,  new  more  systemic  approaches  are  needed  to  analyse,  design  and 
evaluate  activity  in  smart  environments  (AES  2005).  Principles  of  an  ecological 
approach  to  smart  environment  design  should  be  created  in  interdisciplinary  work.  We 
have  defined  four  principles  that  are  currently  under  conceptual  and  empirical  study: 

20.3. 1  Consider  human-environment  interaction  methodologically  as  one 

functional  system. 

In  the  design  of  smart  environments  the  human-environment  interaction  (transaction) 
should,  from  a  methodological  point  of  view,  be  conceived  as  one  functional  system 
(Ingold  2000,  Jarvilehto  2000).  Such  a  functional  system  explains  behaviour  as  being 
structured  according  to  its  results  and  with  regard  to  the  constraints  and  possibilities  of 
maintaining  action.  It  does  not  perceive  behaviour  in  simple  linear  causal  relations. 
Cognition  is  conceived  as  embedded  and  distributed  within  the  elements  of  the  system 
and  intelligence  is  characteristic  of  the  whole  (Hollan  et  al  2000).  Ecological  design  of 
smart  environments  focuses  on  developing  appropriate  functional  systems. 
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20.3.2  In  the  design  of  smart  environments  focus  on  the  dynamics  of  an  adaptive 
human-environment  system. 

As  the  notion  of  ecology  assumes  it  is  necessary  to  analyse  the  interactions  and 
developmental  dynamic  phenomena  that  take  place  within  the  human-environment 
system.  We  see  it  important  to  develop  means  to  understand  the  result-oriented 
organisation  of  human  behaviour  in  smart  environments,  to  elaborate  the  organisation 
by  understanding  the  diverse  spatial  and  temporal  connections  between  different 
functional  systems  and  activities  into  which  people  may  be  involved  simultaneously.  In 
this  analysis  we  consider  the  environment  from  the  point  of  view  of  the  possibilities  and 
constraints  it  provides  for  action,  and,  correspondingly,  human  action  from  the  point  of 
view  of  the  generic  dispositions  that  enable  making  sense  and  use  of  the  possibilities. 
Consequently,  the  concepts  of  affordance  (Gibson  1977)  and  habit  (Peirce  1998), 
respectively,  are  exploited  in  the  analysis  of  the  understanding  of  the  dynamics  (Norros 
2004).  This  approach,  that  considers  the  generic  potential  for  action  and  distinguishes  it 
from  the  description  of  particular  courses  of  actions  opens  a  way  to  understand  the 
adaptiveness  of  human-action. 

We  also  consider  that  a  historical  dimension  is  necessary  to  understand  the  structuring 
of  activities.  Challenging  thoughts  of  the  role  of  technology  in  moulding  human 
perception  and  consciousness  were  brought  up  by  Marshal  McLuhan  (McLuhan  1964). 
By  the  expression  “media  is  the  message”  de  claimed  that  media  provide  the 
background  that  shapes  human  perception  and  consciousness.  We  see  possibilities  to 
make  use  of  McLuhan 's  conceptualisations  of  the  generic  dynamics  of  the  influence  of 
technologies  (McLuhan  &  McLuhan  1988).  Particularly  relevant  may  be  to  consider  his 
ideas  of  the  nature  of  electric  medium.  According  to  McLuhan  it  is  the  role  of  the  artists 
to  reveal  the  impact  of  media  on  our  perception,  thinking  and  action.  Without  artists, 
human  actors  merely  adapt  to  their  technology,  he  claims.  Human-technology 
interaction  research  should  be  able  to  learn  from  the  arts  and  artists  and  strive  for  the 
articulation  and  understanding  of  the  immediate  background  effect  of  technologies. 

20.3.3  Consider  usage  and  design  as  two  functions  in  artefact  genesis 

There  are  three  issues  that  every  approach  within  HTI  research  has  to  tackle.  The  first  is 
to  conception  of  design,  the  second  the  conception  of  the  user  activity  (which  was 
discussed  above  in  point  1),  and  the  third  the  conception  of  interaction  between  design 
and  usage  (Carrol  1997).  In  developing  the  ecological  design  it  is  necessary  that  we 
analyse  our  relationship  in  all  these  issues. 

Design  is  today  usually  considered  as  an  iterative  process.  This  definition  of  the  process 
of  design  is  of  course  an  important  starting  point.  We  claim,  however,  that  the  current 
design  concepts  could  benefit  from  extending  their  definition  of  what  is  the  object  of 
design.  We  see  that  today  the  product  is  usually  conceived  as  the  object  of  design. 
Consequently,  design  process  itself  will  be  tackled  as  a  very  tightly  constrained  linear 
(even  though  iterative)  process  of  actions  that  enable  the  production  of  the  result.  It  will 
also  be  evaluated  against  well-defined  success  criteria  and  the  quality  of  the  design 
process  is  defined  through  a  good  controllability  of  the  process.  If  the  object  of  design  is 
comprehended  as  creation  of  new  possibilities  for  human  activity  the  process  becomes 
much  more  uncertain  but  also  creative.  This  is  what  so  called  concept  design  is  all  about. 
There  are  examples  that  show  that  leading  manufacturers  in  particular  domains  have 
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adopted  concept  design  as  a  tool  to  project  their  future  business  activities  and  to  vision 
new  ways  and  values  of  usage  (Keinonen  &  Jaasko  2003). 

Interaction  between  design  and  usage  is,  of  course,  long  been  identified  an  important 
issue  in  good  design.  This  principle  is  already  implicit  in  the  concept  of  iterative  design. 
We  claim  however,  that  these  two  activities  have  often  been  treated  as  interacting  with 
each  other  in  a  more  or  less  external  manner,  without  themselves  itself  becoming 
pressed  to  transform  in  this  interaction.  Design  is  treated  from  a  process  point  of  view, 
usage  sporadically  via  user  tests.  In  the  ecological  design  concept  that  is  more  and  more 
interested  in  creating  new  possibilities  and  ways  for  living,  it  also  necessary  to  pay  more 
attention  to  understanding  the  activity  by  which  these  possibilities  may  be  created. 

The  approach  that  has  been  coined  the  instrumental  genesis  approach  (Beguin  & 
Rabardel  2000)  advocates  the  idea  of  parallel  development  of  activity  (instrumentation) 
and  the  tool  (instrumentalisation).  This  process  takes  place  in  a  collaborative  process  in 
which  both  designers  and  users  are  active  actors  and  undergo  a  learning  process.  In  our 
own  studies  we  have  been  able  to  describe  and  verify  the  learning  processes  of  users 
with  reference  to  their  subjective  disposition  to  the  developing  instruments  and  their 
conception  their  own  role  as  users  (Norros  1996). 

20.3.4  Exploit  an  integrated  contextual  assessment  of  the  appropriateness  of  the 
design  outcome 

Evaluation  of  usability  of  artefacts  is  an  existing  practice  in  human-technology 
interaction  research.  It  should  be  no  surprise  that  in  an  ecological  design  approach  new 
evaluation  concepts  must  be  developed.  More  problematic  is  to  comprehend  how  the 
present  evaluation  processes,  practices,  indicators  and  criteria  should  be  developed  so 
that  they  would  grasp  essential  features  of  goodness  of  smart  environments.  In  the 
following,  some  tentative  ideas  are  brought  up. 

In  our  own  ongoing  work  we  have  used  the  concept  of  systems  usability  as  a  tool  of 
incorporating  the  developing  evaluation  concept  (Savioja  &  Norros  2004,  Savioja  & 
Norros  2005).  The  notion  systems  usability  indicates,  first,  the  need  to  comprehend  the 
smart  artefact  or  environment  in  a  holistic  manner.  The  artefact  will,  according  to  our 
ideas  of  the  technological  nature  of  ICT,  serve  the  above  mentioned  three  basic 
functions  at  the  same  time.  These  were  the  instrumental,  the  cognitive  and  the 
communicative  function.  Accordingly,  it  is  necessary  to  reflect  the  artefact  from  all 
these  points  of  view. 

We  see  further  that  in  order  to  succeed  in  such  an  integrated  evaluation  the  artefact  must 
studied  in  usage.  Consequently,  contextual  and  performance-based  assessments  are 
necessary.  We  exploit  the  semiotic  meaning  relationship  model  of  Charles  Sanders 
Peirce  (1991)  to  develop  a  contextual  evaluation  basis  for  artefacts.  Hence,  we  consider 
the  presentation  of  user  interface,  content  of  information  and  the  user  performance  in 
connection  with  each  other  (Savioja  &  Norros  2005).  We  developed  this  approach  on 
the  basis  of  our  work  on  users’  practices,  and  found  that  corresponding  ideas 
specifically  with  relation  to  interface  design  were  proposed  and  developed  by  Woods 
(Woods  1995). 

In  developing  the  performance-based  assessments  we  have  proposed  a  conception  to 
distinguish  between  outcome  evaluation  and  evaluation  of  practices.  The  former  is  seen 
to  express  what  has  been  called  external  good  of  practice,  whereas  the  latter  focuses  on 
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what  is  considered  as  internal  good  of  practice  (MacIntyre  1984).  The  latter  features, 
and  habit-related  indicators  developed  from  them,  are  definable  only  by,  and,  in  co¬ 
operation  with  the  practitioners.  They  enable  projecting  the  future  potentials  of  the 
artefacts  and  usage. 

The  most  important  integrative  indicator  in  the  performance-based  assessment  is 
connected  to  experiences  of  the  users  and,  also  the  designers,  of  the  potentiality  of  the 
concept  or  the  designed  product  to  become  a  part  of  a  significant  practice.  This  indicator 
is  emotionally-laden,  which  is  the  strength  of  the  indicator.  (Battarbee  2004,  Norman 
2004).  It  may  namely  be  argued  that  the  users  will  experience  a  positive  emotion  when 
they,  as  experts  of  their  work  and  everyday  life,  identify  a  genuine  new  possibility  of 
action.  The  evaluator  should,  however,  remember  that  when  seeking  proof  of  such 
experiences  it  should  be  necessary  to  consider  the  effect  of  the  artefact  in  both 
scientifically  rational  and  practically  rational  sense,  as  G.H.  von  Wright  would  demand 
of  a  truly  humanistic  development  of  technology. 

In  conclusion  following  generic  research  challenges  for  constructing  smart 
environments  may  be  identified: 

20.4  Conclusions 

•  Analysis  of  what  are  the  ecologically  critical  features  of  the  new  environment  and 
how  they  shape  human  perception  and  thinking 

•  Methods  for  defining  context,  functional  analysis  of  the  domain  and  tasks 

•  Research  on  new  skills,  competencies  and  new  forms  of  learning 

•  Conceptualisation  and  structuring  human-technology  team  work 

•  Deepening  the  comprehension  of  user  acceptance  of  technology 

•  Improving  understanding  of  artefact  genesis  and  designer’s  work  to  improve  the 
innovativeness  of  design 

•  Development  of  evaluation  dimensions  and  acceptance  criteria  of  systems 
usability 

•  Understanding  technological  diversity  and  integration  in  improving  the  viability 
of  the  human-environment  systems  and  promoting  sustainable  development 
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21.  NYSSEN,  ANNE-SOPHIE :  WORK  ANALYSIS  FOR  DESIGNING 
TECHNOLOGY  -  INTEGRATING  THE  PSYCHO-SOCIAL 
ORGANIZATION  OF  WORK  TO  SUPPORT  THE  DESIGN  PROCESS 


During  the  last  two  decades,  system  engineering  has  been  largely  influenced  by  the 
development  of  ‘Human  Factors’  approaches  attempting  to  incorporate  the  user’s  needs 
into  the  design  process. 

The  first  source  of  influence  was  Cognitive  Psychology.  Its  progressive  influence  is 
traceable  through  the  evolution  of  the  ‘politically  correct’  concept  of  the  time:  from 
‘experts  systems’,  through  ‘intelligent  decision  supports’,  ‘prostheses’,  to  ‘control  tools’. 
In  some  way,  this  vocabulary  shift  reflects  the  growing  humility  that  designers  had  to 
acquire  when  trying  to  mimic  complex  human  cognitive  activity.  Not  surprisingly, 
cognitive  activity  analysis  was  then  placed  at  the  center  of  this  approach,  focusing  on 
information  processing,  mental  resources  management,  decision  making  and  adaptation. 

The  second  source  was  the  Scenario-Based  Design  approach,  stressing  the  user’s 
contextual  point  of  view.  One  key  element  in  this  perspective  is  the  user-interaction 
scenario,  a  narrative  description  of  what  people  do  and  experience  as  they  try  to  make 
use  of  systems  and  applications. 

Despite  these  valuable  insights,  both  approaches  mentioned  above  suffer  from  some 
incompleteness  when  taken  separately.  For  example,  they  disregard  the  psycho-social 
organization  of  the  work  system,  focusing  on  the  user’s  performance  and  interactions 
with  the  device  rather  than  on  the  system  performance.  I  share  the  contention  initiated 
by  the  so  called  ‘French  Speaking  Ergonomics’  that  only  a  work  analysis  conducted 
with  a  global,  systemic,  point  of  view  can  identify  the  critical  dimensions  of  the  work 
system  performance  that  must  be  integrated  in  the  design  process  in  order  to  respond  to 
the  actual  user’s  needs  under  real  constraints,  hence  facilitate  the  appropriation  of  the 
designed  tool  by  the  end-users  within  a  work  organization.  A  set  of  different  techniques 
is  necessary  to  acquire  a  proper  understanding  of  these  work  constraints:  field 
observations,  questionnaires,  interviews,  simulation. 

Hereafter,  I  discuss  two  studies  conducted  in  the  medical  field,  to  illustrate  how 
important  a  comprehensive  work  analysis  is  for  the  design  of  new  technology  in  order 
to  anticipate  the  impacts  on  the  work  system  performance  and  attempt  to  compensate 
them.  The  first  one  is  about  the  impact  of  a  new  automatic  drug  device  intended  for 
anesthetists,  and  the  second  one  deals  with  the  impact  of  a  new  robotic  surgery  system 
intended  for  surgeons.  Interestingly,  each  of  these  tools  has  been  designed  for  a  specific 
group  of  users  (one  for  anesthetists,  the  other  one  for  surgeons),  in  one  same  space  (the 
operating  room),  performing  a  collective  activity.  More  than  600  hours  of  observation 
were  conducted  in  the  operating  rooms,  as  well  as  on  simulated  tasks,  to  assess  the 
impact  of  introducing  these  artefacts  through  an  extensive  work  analysis. 

In  case  1 ,  the  work  analysis  showed  that,  while  the  new  tool  was  supposed  to  merely 
decrease  the  monitoring  task  of  the  anesthetist  towards  the  patient,  because  the  device 
was  using  a  specific  drug  (Propofol)  with  different  pharmacocinetic  characteristics 
(blood  pressure  reducer  with  short  half-life),  it  actually  influenced  the  global  work 
system  performance: 
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•  creating,  for  the  anesthetist,  a  new  monitoring  task  directed  towards  the  device 
itself, 

•  imposing  that  a  new  way  of  thinking  be  developed  by  the  anesthetists  and  by  the 
nurses  (dosage  (mg/kg/h)  had  to  be  transformed  into  desired  plasmatic 
concentration), 

•  disturbing  the  communication  protocol,  as  this  new  thinking  was  only  valid  for 
the  drug  (Propofol)  used  by  the  device.  The  anesthetists  still  communicate  and 
work  in  terms  of  mg/kg/h  for  the  other  drugs. 

•  increasing,  for  the  anesthetists  and  the  surgeons,  the  frequency  of  the  monitoring 
of  the  blood  pressure, 

•  changing  the  planning  task  because  of  the  short  half-life  propriety  of  the  drug, 

•  reporting  the  monitoring  of  the  critical  awakening  phase  to  a  next  locus  and  to  a 
next  person, 

•  disturbing  the  surgeon’s  work  because  the  short  lasting  drugs  effect  demanded 
that  the  feeding  lines  be  as  short  as  possible,  hence  the  device  be  as  close  as 
possible  to  the  patient’s  body. 

In  brief,  the  very  act  of  introducing  the  new  tool  for  the  anesthetist  had  a  considerable 
and  unanticipated,  while  perfectly  predictable,  impact  on  the  system  key  performance 
constraints,  affecting  monitoring  and  planning  activities,  leading  to  the  introduction  of 
additional  control  loops  (Fig  1),  and  affecting  the  psycho-social  organization  of  the 
work  and  the  cooperation: 

Fig.l  -  Loops  of  control  of  the  H-M  system. 


In  case  2,  work  analysis  showed  the  impact  of  the  surgery  robotic  system  on  the 
physical  and  social  interactions  between  the  actors  of  the  operating  room  (surgeons, 
assistant  surgeons,  anesthetists,  technicians,  nurses): 
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•  The  use  of  the  robot  implies  new  knowledge  and  new  protocol  not  only  for  the 
surgeon  but  for  the  whole  operating  team  relative  to  the  placements  of  the 
instruments  and  the  preparation  of  the  robotic  system. 

•  Although  the  robot  gives  a  three-dimensional  image  to  the  surgeon,  the  team  still 
works  with  a  two-dimensional  picture,  creating  a  rupture  in  the  collective 
representation  of  what’s  going  on.  Overall,  the  need  for  communication  is 
significantly  increased  by  the  robot,  as  shown  by  Fig  2  below. 

•  The  distance  introduced  by  the  system  between  the  surgeon  and  both  the  patient 
and  the  rest  of  the  team  changes  the  role  of  the  members  of  the  team.  There  are 
two  new  actors  in  the  team:  the  robot  and  the  technician  who  become  essentials 
within  the  team.  The  surgeon  assistant  becomes  more  like  a  technician  and  is 
sometimes  replaced  by  the  technician. 

•  The  arms  of  the  robot  are  very  cumbersome  which  makes  the  conversion,  in  case 
of  problem,  quite  awkward. 

Here  also,  the  introduction  of  the  new  tool  had  a  considerable  and  unanticipated,  while 
perfectly  predictable,  impact  on  the  psycho-social  organization  of  the  work  and  the 
cooperation.  This  plays  a  large  role  in  how  the  end-users  and  the  team  perceive,  accept 
and  use  the  device  within  the  organization. 

Fig.  2  -  Comparison  of  communication  between  robotic  and  classical  laparoscopy 
surgeries. 


order  handling  relaxation  irritation 


Type  of  communication 


These  two  studies  insist  on  the  importance  for  designers  to  assess  the  impact  of  the  new 
tool  from  a  global,  systemic  point  of  view,  taking  into  account  the  psycho-social 
organization  of  the  work,  rather  than  only  the  user’s  point  of  view.  Only  work  analysis 
using  different  techniques  to  collect  data  (field  observations,  questionnaires,  simulation) 
can  provide  a  useful  window  into  the  work  system  performance,  the  work  constraints, 
and  thereby  a  systematic  basis  for  designing  devices  that  workers  need  and  use  within 
the  organization. 
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22.  PETERSEN,  JOHANNES:  INTEGRATION  AND  INTERPRETATION  OF 
DATA  FROM  COMPLEX  WORK  DOMAINS 

In  process  control  it  is  important  that  operators  can  identify  the  state  of  the  work  domain 
in  any  situation  based  on  representations  of  the  work  domain  mediated  by  the 
supervisory  control  system.  Therefore  the  design  of  representations  of  the  work  domain 
that  can  support  the  integration  and  interpretation  of  data,  as  well  as  reasoning,  has 
played  a  major  role  in  the  Cognitive  Systems  Engineering  tradition  (e.g.  (Woods  & 

Roth,  1988)). 

Representation  design  involves  considerations  about  aspects  such  as:  1)  Domain 
Content:  the  work  domain  properties  that  need  to  be  captured,  2)  Content  Form:  the  type 
of  representations  used  to  capture  the  relevant  work  domain  properties,  and  3) 
Expression  form:  the  physical  expression  of  the  domain  content  in  the  human-machine 
interface.  For  a  discussion  of  these  distinctions  from  a  semiotic  point  of  view  see  the 
position  statement  by  Michael  May. 

This  position  statement  focuses  mainly  on  the  second  aspect  -  content  form.  Different 
layers  of  representational  types  are  described,  and  their  role  in  the  data  integration  and 
interpretation  process  is  discussed.  Furthermore,  links  are  drawn  to  the  Abstraction 
Hierarchy  and  Ecological  Interface  Design  (EID). 

22.1  Three  layers  of  representational  types 

Petersen  (2004)  describes  the  relations  between  three  layers  of  representational  types 
(the  so-called  three  layer  model)  and  their  role  in  the  data  integration  and  interpretation 
process.  The  different  layers  of  representational  types  are:  1)  variables,  2)  constraints 
(relations  among  variables),  and  3)  relations  among  objects.  The  bottom  layer  contains 
system  variables  referring  to  dimensions  of  the  work  domain.  The  upper  next  layer 
contains  constraints  describing  relations  between  variables  and  at  the  upper-most  layer 
the  work  domain  is  represented  in  terms  of  objects  that  interact  causally. 

It  is  important  to  emphasize  that  the  symbolic  reference  of  the  representational  types  in 
the  three-layer  model  depend  on  the  actual  conceptualization  of  the  work  domain.  For 
instance,  an  object-centered  description  may  refer  to  functions  of  physical  components 
or  systems. 

Constraints,  specifying  proper  functioning  of  the  work  domain,  are  fundamental  in  order 
to  cope  with  unanticipated  events  (e.g.  (Lind,  1981)  (Vicente  and  Rasmussen,  1992)).  In 
the  three-layer  model  such  constraints  are  related  to  an  object-centered  description  of 
function.  Typically  the  relations  between  the  object-centered  layer  and  the  constraint 
layer  are  many-to-many.  That  is,  several  constraints  may  be  needed  to  specify  the 
proper  functioning  of  an  object-centered  function  description  and  the  same  constraints 
may  be  used  to  specify  the  proper  functioning  of  several  functions. 

Multilevel  Flow  Modeling  (MFM)  offers  an  object-centered  language  for  description  of 
the  functional  structure  of  complex  technical  systems  (Lind,  1999).  The  object-centered 
representations  offered  by  MFM  are  linked  systematically  to  a  constraint  description. 

See  Petersen  (2000,  2001)  for  an  account  of  causal  reasoning  based  on  MFM. 
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22.2  The  link  to  the  Abstraction  Hierarchy 

According  to  Rasmussen  (1986)  operators  supervising  a  complex  system  need  to  attend 
to  system  representations  at  different  levels  of  means-end  abstraction.  The  means-end 
abstraction  levels  imply  different  conceptualizations  of  a  work  domain  and  the  three- 
layer  model  may,  in  principle,  be  instantiated  at  any  of  the  means-end  levels.  In  other 
words,  the  means-end  abstraction  levels  proposed  by  Rasmussen  and  the  different  layers 
of  representational  types  described  above  are  orthogonal.  The  former  focuses  on  the 
content  of  the  work  domain,  whereas  the  latter  focuses  on  the  relevant  content  form,  i.e. 
how  the  work  domain  content  is  represented. 

22.3  Generic  inference  steps 

This  section  is  concerned  with  inferences  in  the  data  integration  and  interpretation 
process.  Generic  inference  steps,  defined  on  the  basis  of  the  different  layers  of 
representational  types  described  above,  are  proposed.  Lind  (1988)  has  used  a  similar 
approach  to  illustrate  the  integration  and  interpretation  process  in  MFM. 

At  the  variable  layer,  data  reflect  the  quantitative  and  qualitative  value  of  variables,  at 
the  constraint  layer  data  reflect  the  state  of  constraints,  and  at  the  object-centered  layer 
data  reflect  the  state  of  objects.  Below  the  different  generic  inference  steps  are  described. 

Integration.  Integrating  variables  into  (higher-order)  variables  (e.g.  velocity  is  based  on 
two  variables:  distance  and  time) 

Derivation.  A  (multivariate)  constraint  can  be  used  to  derive  the  value  of  a  (higher- 
order)  variable  from  the  values  of  known  variables  (no  matter  whether  these  are  directly 
measured  or  derived). 

Variable  state  identification.  A  single  variable  constraint  (e.g.  defined  by  minimum  and 
maximum  values)  can  be  used  to  identify  the  state  (qualitative  value)  of  a  variable  (e.g. 
low/normal/high) . 

Constraint  state  identification.  Based  on  the  value  of  the  variables  entering  into  a 
constraint,  it  is  possible  to  identify  the  state  of  the  constraints  (violated/not-violated). 
When  the  values  of  the  variable  are  inconsistent  with  the  constraint  defining  the 
interrelations  between  the  variables,  the  constraint  is  violated. 

Object  (function)  state  identification.  Based  on  the  state  of  constraints  (violated/not- 
violated)  it  is  possible  to  identify  the  state  of  object-centered  functions.  If  the 
constraint(s)  specifying  the  proper  function  is  (are)  violated  the  function  is  failed, 
otherwise  the  function  is  ok. 

Causal  reasoning  based  on  an  object-centered  model.  Reasoning  about  the  state  of  the 
work  domain  based  on  an  object-centered  model  representing  causal  relations  among 
objects. 

The  inference  steps  just  described  reveal  different  outcomes  of  the  comparison  process 
between  data  and  constraints  that  specify  proper  functioning.  For  single  variable 
constraints,  for  instance,  the  comparison  process  may  result  in  a  classification  of  some 
variable  value,  an  identification  of  the  state  of  a  constraint,  or  an  identification  of  the 
state  of  an  object-centered  function.  In  the  first  case,  the  quantitative  value  of  a  variable 
is  transformed  into  a  qualitative  value  (e.g.  low/normal/high).  In  the  second  case  the 
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quantitative  value  of  a  variable  is  used  to  identify  the  state  of  a  constraint  (violated/not- 
violated)  and  in  the  third  case  the  value  of  the  constraint  state  is  used  to  identify  the 
state  of  a  object-centered  function  of  the  work  domain  (failed/ok). 

In  unfamiliar  situations  it  is  crucial  that  operators  are  aware  of  the  implications  of  a 
violated  constraint  in  terms  of  disturbed  goals  and  functions  at  the  object-centered  layer. 
It  is  important  to  support  reasoning  about  causes  and  consequences  at  a  plant-wide  level 
based  on  a  representation  of  goals  and  functions  of  the  work  domain.  This  requires  a 
specification  of  the  relation  between  the  object-centered  description  of  functions  (and 
goals)  and  the  constraints  specifying  proper  functioning. 

22.4  The  link  to  EID 

In  the  literature  describing  applications  of  EID  it  is  hard  to  find  discussions  of  different 
types  of  representations  of  the  work  domain  and  their  interrelations.  Sometimes  the 
focus  is  on  constraints:  “Because  the  system  was  built  in  a  certain  way,  for  a  certain 
purpose,  there  will  be  certain  relationships  between  variables.  These  relationships  can 
be  described  as  constraints....  [the  abstraction  hierarchy]  provides  a  framework  for 
identifying  and  integrating  the  set  of  goal  relevant  constraints  that  are  operating  in  a 
given  work  domain.  Each  level  in  the  hierarchy  represents  a  different  class  of 
constraints...”  (Vicente  and  Rasmussen,  1992,  p.  592)  and  sometimes  the  focus  is  on 
relations  among  objects:  “The  AH  was  used  as  a  basis  for  developing  a  formal 
representation  of  DURESS.  DURESS  was  described  in  terms  of  objects  which  comprise 
the  system  at  each  level  of  abstraction,  along  with  the  means-end  links  connecting  those 
objects  across  levels”  (Bizantz  and  Vicente,  1994,  p.  88).  Apart  from  a  few  exceptions 
(e.g.  (Reising  and  Sanderson,  2002)  and  (Liu  et  al.,  2002))  representations  of  the 
variables,  constraints  and  relations  among  objects  are  typically  separated  (see  e.g. 
(Bizantz  and  Vicente,  1994)  and  (Ham  and  Yoon,  2001)).  According  to  the  authors 
knowledge  the  EID  literature  offers  no  systematic  treatment  of  the  combination  of 
constraint  and  object-centered  representation. 

A  prototypical  EID  interface  focuses  on  work  domain  constraints  and  displays  variables 
in  a  way  that  allows  the  operator  to  compare  perceptually,  based  on  geometrical 
constraints  in  the  interface,  the  current  behavior  of  the  work  domain  with  the  behavior 
that  is  expected  from  the  work  domain  constraints  (e.g.  (Vicente  and  Rasmussen,  1992)). 
EID  is  opposed  to  a  traditional  one-sensor-one-indicator  interface  which  simply  shows 
the  values  of  the  sensed  and  derived  variables  by  means  of  separable  dimensions.  It  is  a 
well-known  fact  that  a  one-sensor-one-indicator  interface  provides  poor  support  for 
operators  supervising  a  complex  work  domain  because  it  leaves  operators  with  the 
burden  of  integrating  and  interpreting  data. 

A  complementary  approach  to  interface  design,  supporting  causal  reasoning  at  a  plant¬ 
wide  level,  would  be  to  make  explicit  the  result  of  the  comparison  process  between 
current  and  expected  behavior  in  terms  of  the  state  of  object-centered  descriptions  of 
system  functions.  In  this  approach  the  constraints  only  have  a  secondary  role  to  play, 
serving  as  means  for  state  identification  of  object-centered  functions  (refer  to  the 
inference  steps  described  above). 

Actually,  interface  design,  based  on  an  object-centered  description  of  function,  is 
mentioned  implicitly  in  the  theoretical  basis  of  EID.  More  specifically,  for  interaction  at 
the  knowledge-based  level,  it  is  argued  that  the  operator  is  supposed  to  have  access  to 
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an  abstraction  hierarchy  representation  of  the  work  domain,  given  in  terms  of  relations 
among  objects.  Nevertheless,  this  type  of  representation  is  almost  never  considered  in 
the  applications  of  EID.  Furthermore,  the  visualization  of  object-centered  representation, 
based  on  some  expression  form,  is  not  treated  systematically  in  the  EID  literature. 
Obviously  it  is  not  feasible  to  use  geometrical  constraints  for  the  presentation  of  object- 
centered  content  form.  Instead,  some  sort  of  diagrammatic  representation  format  would 
probably  be  useful.  For  a  general  discussion  of  the  mapping  between  domain 
abstractions  and  interface  representations  see  the  position  paper  by  Michael  May. 
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23.  PRITCHETT,  AMY:  'PROCEDURES’  AND  DECISION  SUPPORT 

Several  times  as  part  of  an  afternoon's  work  I  have  read  descriptions  of  “procedures”  as 
normative  task  structures  imposed  on  workers  by  some  entity  remote  from  the  workers 
both  geographically  and  in  terms  of  awareness  of  the  worker's  context.  Each  time,  I  then 
crossed  off 'Read  paper'  on  my  day's  to-do  list,  and  maybe  wrote  out  a  list  of  errands  to 
do  on  the  way  home  —  a  shopping  list  for  that  night's  dinner,  perhaps  —  to  take  with  me 
at  the  end  of  the  day.  Perhaps  I  am  unusually  anal  (I  would  prefer  to  say  'organized'),  or 
perhaps  I  am  compensating  for  a  weak  memory  (I  would  prefer  to  say  'absent-minded')  - 
-  but  I  would  like  to  discuss  how  we  view  'procedures'  as  a  construct  relative  to  the 
design  of  cognitive  aiding. 

Has  the  literature  typecast  procedures  in  an  overly  narrow  sense?  I  think  so.  I  have 
agreed  with  all  the  examples  given  of  'bad  procedures'  and  'over-reliance  on  procedures', 
yet  I  also  find  in  my  own  research  —  and  day-to-day  activities  —  many  positive  roles  for 
procedures.  Some  of  these  roles  are  certainly  bad  and  should  be  prevented:  the  perils  of 
imposing  contextually-inappropriate  normative  work  structures  has  been  well 
documented,  yet  my  own  recent  research  into  decision  aids  for  airline  'schedule- 
adherence  managers'  has  found  the  same  implicit  and  pervasive  in  technologies  intended 
to  'help'.  However,  other  roles  of  procedures  are  effective  or,  in  some  cases,  vital.  In  my 
main  research  domain,  air  transport  cockpits,  proper  procedure  following  is  a  sign  of 
professionalism;  correspondingly,  the  procedures  are  carefully  constructed,  vetted, 
debated  and  re-designed  with  pilot  input,  and  are  held  in  common  as  a  resource 
providing  a  demonstrably-safe  task  progression  through  an  otherwise  under¬ 
constraining  physical  environment.  When  teaching,  lab  procedures  establish  a 
scaffolding  for  students,  quickly  getting  them  participating  in  complex  tasks  they  could 
not  otherwise  perform;  from  this  viewpoint,  instruction  is  knowing  when  and  how  to 
fade  out  the  procedural  scaffolding  as  students'  conceptual  understanding  grows.  As  an 
engineer,  I  believe  the  best  procedure  to  achieve  an  end  is  best  framed  as  a  subject  of 
analysis,  research  and  design  —  and  as  a  product  which  can  encapsulate  many  salient 
affordances  and  constraints  in  the  environment. 

In  addition,  now  that  I  find  myself  introspecting  on  my  day-to-day  activities  as  part  of  a 
team  effort  (i.e.,  two  career  professionals  becoming  parents  and  needing  to  run  a 
household  through  coordinated  behaviors),  procedures  also  serve  to  provide  a  'co¬ 
ordination-structure'  to  our  environment  that  the  physical  environment  alone  can  not 
afford.  Why  is  it  a  red  traffic  light  that  constrains  forward  travel  (hopefully)  and  a  green 
light  that  affords  travel?  It  is  not  to  enable  me  in  isolation  to  run  my  errands  in  the 
evening,  but  instead  to  coordinate  our  collective  activity  through  prescriptions  and 
proscriptions  on  individual  behaviors.  We  could  build  physical  structures  into  the 
environment  to  create  these  constraints  and  affordances  —  traffic  barriers,  perhaps,  that 
swing  into  place  in  lieu  of  red  lights,  physically  obstructing  traffic  —  but  we  find  that 
procedures  often  satisfy  the  purpose  with  little  or  no  tangible  manifestation.  Using  them, 
I  can  drive  to  the  grocery  store  using  pre-coordinated  behaviors,  and  I  can  form 
expectations  such  as  whether  crossing  traffic  will  stop  or  continue. 

A  procedure  may  be  judged  on  its  level  of  detail,  its  comprehensiveness  relative  to 
operating  context,  and  its  accuracy.  It's  hard  to  find  a  procedure  that  scores  high  on  all 
three  metrics;  at  a  minimum,  an  'effective'  procedure  must  be  'accurate',  by  which  I 
mean  it  must  prescribe  or  proscribe  behaviors  as  appropriate  to  achieving  goals  within 
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the  environment.  Decision  aids,  then,  may  use  these  prescriptions  and  proscriptions  as 
structures  to  mimic  established  work  practices  and  to  scaffold  novice  behavior  (or 
behavior  in  novel  situations).  In  addition,  a  well-designed  procedure  needs  to  be  created 
through  examination  of  the  environment,  and  thus  has  many  contextual  relations 
implicit  to  it.  My  list  of  errands  may  put  'pick  up  laundry  at  cleaners'  first  and  'buy  ice 
cream'  last  due  to  the  former's  proximity  to  my  starting  point  and  the  latter  needing  to  be 
driven  quickly  home  before  it  melts  in  the  Atlanta  heat.  Our  common  representation  of  a 
procedure  —  a  check-list  or  do-list  for  example  —  may  not  display  these  affordances  and 
constraints,  but  a  decision  aid  can.  In  addition,  a  decision  aid  can  make  them  explicitly 
situate  them  relative  to  recognizable  behaviors  and  desired  outcomes. 
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24.  RIZZO,  ANTONIO;  POZZI,  SIMONE;  SAVE,  LUCA:  DESIGNING  THE 
EVOLUTION  OF  INTENTIONAL  AFFORD ANCES 

24.1  Introduction 

As  it  is  widely  recognised  by  theoretical  approaches  as  distributed  cognition  (Hutchins, 
1995)  or  activity  theory  (Nardi,  1996),  an  IDSS  does  not  need  to  be  a  complex  software 
system.  Rather  any  tool  that  supports  the  human  activity  can  be  defined  as  an  intelligent 
support  to  the  decision,  because  by  modifying  the  tasks  in  which  the  human  actor  is 
involved  it  also  affects  the  nature  of  his/her  decisions.  In  the  last  20  years,  the  ambitious 
expert  systems  designed  in  the  Seventies  have  given  way  to  more  focused,  narrow,  in  a 
sense  specialised  support  tools.  Full  automation  is  no  longer  pursued,  as  it  proved  to  be 
unable  to  handle  complex  and  dynamic  work  settings  and  demands,  not  showing  the 
requisite  flexibility.  The  design  objective  has  moved  to  provide  the  human  actors  with 
different  types  of  supporting  tools  that  can  be  opportunistically  adopted  and  requested 
in  different  conditions.  As  a  consequence,  the  flexibility  of  the  intelligent  support  tools 
has  increased.  IDSS  can  now  be  exploited  even  in  front  of  highly  variable 
environmental  conditions,  whilst  the  typical  expert  automated  system  had  not  been  able 
to  efficiently  adapt  to  conditions  outside  of  the  designed  space.  The  variety  and  number 
of  the  support  tools  are  better  suited  to  effectively  cope  with  varying  conditions  and 
dynamic  environment. 

In  the  current  context,  the  core  design  issue  is  no  longer  to  provide  support  for  the 
correct  application  of  rules,  nor  to  inform  the  meta-level  selection  of  the  correct  set  of 
rules.  Rather,  it  has  moved  to  foster  the  identification  of  appropriate  goals  considering 
the  available  tools.  This  process  may  also  imply  the  adoption  of  tools  for  different 
purposes  than  those  originally  intended.  In  this  respect  users  can  go  beyond  what  was 
expected  and  foreseen  by  the  tool  designer  and  can  devise  additional  and  innovative 
interaction  modalities. 

The  history  of  technology  offers  plenty  of  examples  of  creative  uses,  of  shifts  from  one 
original  intended  use  to  completely  new  ones.  For  instance,  the  first  audio  recording  and 
playback  device  (the  Edison’s  phonograph)  was  designed  to  preserve  and  distribute 
personal  vocal  notes  and  audio  documents  in  work  settings  such  as  lawyers’  offices. 
However,  the  actual  development  of  this  technology  evolved  in  a  completely  different 
direction.  A  similar  competing  technology  (the  gramophone)  was  used  to  reproduce 
over  and  over  standardised  contents  (e.g.  popular  songs,  operas  and  classical  music)  and 
to  distribute  them  to  wide  audiences.  This  finally  ended  up  with  the  death  of  the 
phonograph  as  a  commercial  product,  with  the  gramophone  becoming  the  market 
standard.  In  other  words,  a  recording  device  turned  itself  into  a  playback  support  for 
entertainment.  Paradoxically,  the  opposite  direction  is  nowadays  followed  by  the 
fashionable  iPod(iTunes.  IPod  was  conceived  and  designed  simply  as  an  advanced 
digital  walkman.  Instead,  a  growing  number  of  users  started  recording  their  own 
personal  notes  (e.g.  comments  to  modem  art  exhibitions,  news  and  discussion  on 
innovative  technologies,  etc.),  to  share  and  distribute  them  via  dedicated  web  sites  (a 
practice  known  as  Podcasting,  from  iPod  and  broadcasting). 

24.2  Theoretical  foundations:  the  cultural-historical  psychology 

The  continuous  shift  of  the  artefact  use  has  been  theorised  by  cultural-historical 
psychologists  since  the  beginning  of  the  20th  century.  The  cultural-historical  approach 
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recognised  that  tools  cannot  be  considered  in  isolation  from  the  human  activity  in  which 
they  are  exploited  (Vygotskii,  1978)  (Wertsch,  1985).  Tools  and  human  activities 
should  always  be  considered  in  a  dialectical  relationship.  By  being  part  of  human 
actions,  a  tool  gets  modified  by  the  activity  and  modifies  the  activity  itself. 

In  this  line  of  reasoning,  taking  the  right  decision  is  no  longer  finding  the  solution 
within  the  boundaries  of  a  given  configuration  of  tools,  goals  and  environmental 
conditions.  Dynamic  and  complex  settings  require  the  adoption  of  an  opportunistic 
strategy  in  the  evolution  of  tools  and  goals.  The  aim  of  an  IDSS  can  thus  be  rephrased 
as  supporting  the  user  in  structuring  the  appropriate  configurations  of  tools-goals.  In 
details,  this  also  implies  the  awareness  of  the  dialectical  relationship  between  tools  and 
goals.  This  can  be  achieved  by  knowing  the  design  rationale  of  the  tool  (i.e.  why  the 
designer  made  the  tool  as  it  is)  and  past  instances  of  tool  use  in  socio-cultural  contexts 
(i.e.  how  previous  users  used  the  tool). 

To  address  this  issue,  within  the  cultural-historical  approach  (and  our  revised  unit  of 
analysis,  Rizzo,  et  al.  2004),  we  propose  an  elaboration  of  the  concept  of  affordance 
based  on  the  work  of  J.J.  Gibson  and  M.  Tomasello. 

24.3  Bringing  opportunities  of  action  to  the  front:  the  concept  of  intentional 
affordances 

An  affordance  may  be  defined  as  an  action  opportunity  in  the  world,  for  a  human  actor 
that  has  specific  sensory-motor  capabilities.  The  key  point  is  that  the  concept  of 
affordances  is  of  a  relational  nature.  An  affordance  does  not  exit  independently  in  the 
world,  but  only  as  an  interaction  possibility  between  an  actor’s  capabilities  and  the 
world.  The  present  paper  will  propose  to  further  articulate  this  initial  definition  and  to 
distinguish  (i)  sensory-motor  affordances  and  (ii)  intentional  affordances. 

The  category  of  sensory-motor  affordances  is  derived  from  the  works  of  Gibson 
(Gibson,  1979),  who  first  introduced  the  concept  to  explain  the  way  humans  visually 
perceive  the  world.  For  this  position,  an  affordance  is  a  property  of  the  world  which  is 
compatible  or  relevant  for  people’s  interaction.  Thus  sensory-motor  affordances  are 
those  object  properties  that  afford  manipulation  by  an  actor  (e.g.  grasp,  pull,  raise,  etc.). 
This  type  of  affordances  is  related  to  the  human  capabilities  as  developed 
phylogenetically  in  the  human  species,  or  ontogenetically  in  a  specific  human  actor. 

However,  we  may  also  refer  to  Tomasello  (Tomasello,  1999;  Tomasello,  Carpenter, 
Call,  Behne,  &  Moll,  in  press;  Tomasello  &  Rakoczy,  2003)  to  identify  a  second  type  of 
affordances.  Working  in  the  domains  of  comparative  psychology  and  child  development, 
Tomasello  proposed  to  name  as  intentional  affordances  those  object  properties  that  are 
derived  from  the  cultural  uses  of  an  artefact.  Quoting  Cole  (Cole,  1996),  Tomasello 
highlights  that  by  being  part  of  human  activities  artefacts  get  modified  and  acquire  an 
“ideal  part”.  This  part  conveys  the  cultural  habits,  social  conventions  and  knowledge 
about  a  tool  use,  i.e.  those  interaction  modalities  that  derive  from  the  ways  people 
interact  with  that  tool  in  the  socio-cultural  environment,  rather  than  from  the  physical 
properties  of  an  object  (i.e.  what  we  have  named  as  sensory-motor  affordances).  The 
existence  of  intentional  affordances  enables  users  to  place  themselves  in  the  “intentional 
space”  of  other  users,  discerning  others’  goal  and  what  the  others  are  using  the  artefact 
for.  Whereas  sensory-motor  affordances  are  phylogenetically  determined,  intentional 
affordances  derive  from  the  socio-cultural  dimension. 
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At  this  point,  it  is  worthwhile  distinguishing  between  the  existence  of  an  affordance  and 
the  information  that  makes  it  perceivable.  As  clearly  stated  by  Gaver  (1991),  the  two 
dimensions  are  independent  and  there  are  cases  where  affordances  are  not  visible  but 
still  exist,  or  on  the  contrary  cases  where  there  appears  to  be  an  affordance  that  is  not 
actually  present.  This  is  different  from  the  use  of  the  category  that  wad  made  by 
Norman  (Norman,  1988)  to  explain  how  people  can  interact  everyday  with  a  large 
number  of  artefacts  without  apparent  efforts.  As  a  matter  of  fact,  Norman  merged  the 
two  dimensions  and  stated  that  affordances  guide  in  the  use  of  tools  by  making  apparent 
the  possible  ways  of  interacting  with  it.  According  to  Norman,  the  designer’s  task  is  to 
manipulate  affordances  to  support  users  in  making  the  correct  actions  and  to  make  some 
actions  easier  for  the  users.  In  other  words,  users  should  be  guided  in  the  use  of  tools  by 
making  apparent  some  selected  ways  of  interacting  with  it.  1  Instead,  in  our  proposal  we 
would  like  to  maintain  the  difference  between  the  existence  of  the  affordance  and  its 
visibility,  to  clearly  distinguish  two  different  domains  of  design  intervention.  On  one 
side,  affordances  can  be  modified  or  created  by  design,  but  design  efforts  can  also  focus 
on  the  information  on  the  affordance  as  perceived  by  the  user.  Furthermore,  while 
affordances  are  resources  that  the  environment  provides  (afford)  to  a  given  person  and 
that  this  person  may  (or  may  not)  attend  to  and  use,  information  for  affordances  are 
events  that  include  environmental  features,  the  activity  of  the  organism,  and  the 
consequences  that  ensue  as  well  as  the  relations  among  these  (Gibson,  2000). 

Thus  we  have  two  ontological,  but  interrelated,  type  of  affordances  (sensory-motor  and 
intentional)  and  two  different  components  for  each  type  of  affordance  (resources  and 
events). 

24.4  Intentional  affordances  from  the  designer’s  perspective 

From  the  designer’s  perspective,  this  view  open  new  space  for  design,  new  spaces  for 
mediating  human  activity  in  a  more  robust  way,  oriented  toward  a  closer  participation 
of  people  to  the  evolution  of  artefacts  and  human  practices.  In  the  presentation  we  will 
provide  empirical  evidences  (coming  from  comparative  psychology,  neurophysiology, 
and  interaction  design)  supporting  this  conceptualization  of  affordance  and  its 
relationship  to  our  revised  cultural-historical  unit  of  analysis.  Finally  we  will  conclude 
with  an  example  from  our  own  experiences  in  designing  innovative  environments  for 
Air  Traffic  Management. 
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26.  SCHULTE,  AXEL:  COGNITIVE  AUTOMATION  AS  A  SYSTEMS 
ENGINEERING  APPROACH  TO  INTELLIGENT  OPERATOR 
ASSISTANCE  AND  AUTONOMOUS  VEHICLE  GUIDANCE 

Today’s  automation  systems  are  typically  introduced  into  work  systems  as  operation- 
assisting  means  and,  therefore,  being  tools  to  the  human  operator  to  fulfil  certain  well 
defined  sub-tasks  as  part  of  the  work  process.  The  human  operator  is  in  the  role  of  the 
high  end  decision  component  determining  and  supervising  the  work  process.  With 
emergent  technology  highly  automated  work  systems  can  be  beneficial  on  the  one  hand, 
but  automation  may  as  well  cause  its  own  problems. 

A  new  way  introducing  automation  into  work  systems  shall  be  advocated  by  this 
statement,  overcoming  the  classical  pitfalls  of  automation  and  taking  benefit, 
simultaneously.  This  shall  be  achieved  by  so-called  Cognitive  Automation  (CA),  i.e. 
providing  human-like  problem-solving,  decision-making  and  knowledge  processing 
capabilities  to  machines  in  order  to  obtain  goal-directed  behaviour.  A  key  feature  of  a 
cognitive  system  is  the  ability  to  create  its  own  comprehensive  representation  of  the 
prevailing  situation  on  the  basis  of  knowledge  and  observation  and  to  process  superior 
goals  for  acting.  Thereby,  this  kind  of  systems  are  enabled  to  support  the  human 
operator  in  supervision  and  decision  tasks,  then  being  an  operation-assisting  means 
understanding  the  whole  work  objective  and  heading  for  the  achievement  of  the  overall 
desired  work  result.  Programmed  to  pursue  goals  for  co-operation  and  co-ordination 
(e.g.  task  coverage,  avoidance  of  redundancy  or  team  mate  overcharge),  and 
implemented  the  understanding  of  the  situation  (e.g.  opportunities,  conflicts)  and 
actions  of  the  team  mates  (human  or  machine  likewise),  such  cognitive  systems  will 
emerge  as  artificial  co-worker  within  the  work  system,  either  being  an  intelligent 
machine  assistant  to  the  human  operator  in  his  work  place  or  functioning  as  an 
autonomous  intelligent  agent  within  system-of-systems  environments.  Even 
applications  as  automatic,  intelligent  tutoring  systems  are  imaginable. 

In  any  case,  an  Artificial  Cognitive  Unit  (ACU)  has  to  be  created  and  furnished  with  the 
relevant  capabilities  (i.e.  knowledge)  for  the  task  domain,  including  the  capability  to  co¬ 
operate  and  function  in  a  team.  In  order  to  achieve  this,  several  aspects  have  to  be 
considered: 

•  An  appropriate  theory  of  cognition  has  to  be  chosen  or  developed.  In  our  case  the 
so-called  Cognitive  Process  (CP)  will  be  the  theoretical  approach  incorporating 
the  processing  steps  of  information  gathering,  interpretation,  goal  determination, 
planning  and  execution  as  well  as  a  structure  for  partitioning  the  required 
knowledge  according  to  several  criteria,  such  as  a-priori  knowledge  and 
situational  knowledge,  knowledge  specific  for  the  different  processing  steps  (e.g. 
belief,  goals,  plans),  knowledge  specific  for  certain  application  aspects  (packages). 

•  An  appropriate  knowledge  modelling  technique  has  to  be  worked  out.  In  our  case 
it  is  the  so-called  Cognitive  Programming  Language  (CPL),  based  upon  Soar 
(State,  operator  and  result),  being  an  object-oriented  layer  on  top  of  it.  CPL  allows 
the  knowledge  structuring  according  to  the  abovementioned  (belief,  goal,  plan). 

•  Appropriate  knowledge  acquisition  and  elicitation  techniques,  including  machine- 
learning  approaches  have  to  be  found  and  adapted  to  the  application-specific 
needs. 
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•  An  appropriate  system  engineering  tool  implementing  the  CP  has  to  be  developed 
in  order  to  combine  knowledge  packages  into  an  application,  to  interface  with  the 
environment,  to  generate  behaviour  in  terms  of  a  real-time  process  from 
declarative  knowledge  representations  (i.e.  inference),  and  to  provide 
development  support  such  as  debugging.  The  Cognitive  System  Architecture 
(COSA)  developed  at  our  institute  offers  an  engineering  solution  to  these 
requisitions,  presently  being  used  in  technology  demonstration  programmes. 

Currently,  we  are  conducting  several  research  projects  making  use  of  these 
considerations.  Demonstrator  systems  are  being  developed  in  the  fields  of  air-crew 
assistance  for  tactical  helicopter  missions  (civil  and  military),  machine-machine  co¬ 
operation  for  autonomous  UAVs  (Uninhabited  Aerial  Vehicles)  and  manned-unmanned 
teaming  of  remote  operators  and  UAVs. 
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27.  SHARPLE,  SARAH  (WITH  COX,  GEMMA  &  STEDMON,  ALEX): 

CHALLENGES  IN  IDENTIFYING  DECISION  SUPPORT 

REQUIREMENTS  IN  DISTRIBUTED  COLLABORATIVE  SYSTEMS 

Initiatives  have  been  proposed  and  implemented  that  will  affect  the  decision  support 
requirements  in  a  number  of  safety-critical  distributed  collaborative  systems.  This 
statement  and  paper  will  discuss  the  challenges  presented  when  attempting  to  identify 
the  impact  of  introducing  such  technology  in  two  safety  critical  environments:  Pilot-air 
traffic  control  collaboration,  and  railway  signalling  and  control. 

A  number  of  projects  based  in  the  Institute  for  Occupational  Ergonomics  have 
attempted  to  identify  the  introduction  of  technologies  such  as  automatic  route  setting  for 
railway  control,  to  freeflight  and  datalink  in  air  traffic  management.  These  projects  have 
taken  two  methodological  approaches:  laboratory  trials  that  aim  to  examine  key 
elements  of  the  workplace  in  a  controlled  manner;  and  fieldwork  that  takes  a  joint 
cognitive  systems  perspective  to  identify  the  existing  and  potential  impact  of  these 
technologies.  This  statement  will  consider  the  relative  benefits  and  pitfalls  of  these 
approaches  and  examines  how  a  combination  of  laboratory  and  fieldwork  can  best  be 
implemented  when  identifying  decision  support  requirements.  In  addition,  the  particular 
features  of  the  two  safety  critical  environments  of  interest  are  considered  and  their 
impact  on  the  granularity  of  data  collection  and  analysis  that  is  possible  both 
instantaneously  and  retrospectively  are  discussed.  Examples  of  the  data  collected  and 
findings  obtained  will  also  be  presented. 
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28.  SVENMARCK,  PETER:  PRINCIPLES  FOR  EFFICIENT  HUMAN- 
ROBOT  COORDINATION 

Many  types  of  robots  are  currently  being  developed  for  military  applications,  such  as 
reconnaissance,  electronic  warfare,  logistics  and  armed  operations.  Although  the 
characteristics  of  human  operator  control  in  these  applications  are  certainly  different, 
spanning  from  mere  remote  piloting  to  supervisory  control  of  robot-integrated 
automation,  they  all  share  the  problem  of  how  to  achieve  coordination  between  the 
operator’s  and  robot’s  understanding  of  the  situation  as  well  as  coordination  concerning 
appropriate  action.  Addressing  the  coordination  problem  requires  a  deliberate  balance 
between  robot  automation,  information  presentation,  decision  support,  and  display  and 
control  technologies  that  considers  how  the  human-robot  system  as  a  whole  adapts  to 
task  complexities. 

Hollnagel  (2005)  and  Hollnagel  and  Woods  (2005)  characterise  the  task  complexities  of 
human-robot  systems  as  requiring  four  layers  of  control  where  tracking  keeps  the 
system  within  predetermined  performance  boundaries,  regulating  achieves  short-term 
goals,  such  as  specific  manoeuvres,  monitoring  of  the  system  state  relative  the 
environment  for  initiation  of  action  or  goal  setting  for  the  tracking  layer,  and  finally 
targeting  for  achieving  mission  goals.  Additionally,  there  are  interdependencies  between 
the  levels  of  control  where  tracking  may  provide  input  that  is  necessary  for  the  situation 
assessment  required  for  targeting.  Typically,  at  all  levels  there  are  also  interdependent 
tasks  for  control  of  the  robot  and  the  payload.  An  understanding  of  these 
interdependencies  is  important  to  avoid  problems  of  automation  surprises  and  out-of- 
the-loop  performance  when  partly  autonomous  robotic  functions  are  introduced.  Further, 
autonomous  functions  often  changes  the  character  of  the  human-robot  coordination 
problem  from  compensating  for  impoverished  perceptual  cues  and  coordination  of 
direction  of  gaze  and  direction  of  movement  in  remote  piloting,  to  a  more  sophisticated 
coordination  that  requires  knowledge  of  automation  state  and  performance  boundaries. 
The  limiting  factor  for  all  types  of  coordination  problems  is  in  practice,  however,  the 
amount  interaction  that  is  required  to  achieve  coordination  (cf.  Sarter,  Woods,  & 

Billings,  1997). 

Although  the  layers  of  control  may  give  a  reasonable  account  of  the  task  complexities 
there  is  currently  a  need  for  empirical  studies  of  the  task  interdependencies  for  some 
actual  human-robot  systems.  A  discussion  of  suitable  methodologies  for  analysis  of 
some  actual  levels  of  control,  as  well  as  how  to  characterise  the  interaction  for 
coordination  would  therefore  be  greatly  appreciated. 
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29.  SVENSSON,  ERLAND 
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30.  TANGO,  FABIO:  CONCEPT  OF  AUTONOMIC  COMPUTING  APPLIED 
TO  TRANSPORTATION  ISSUES:  THE  SENSITIVE  CAR 


Mobility  is  a  key-factor  in  modem  economics  (with  more  than  10%  of  gross  domestic 
product  and  more  than  10000000  people  employed)  and  thus  all  studies  and  researches 
about  run  towards  a  safety  and  efficiency.  On  the  other  hands  both  society  and 
customers  request  for  it;  in  fact,  the  number  of  road  victims  is  unacceptable  high  (in 
year  2000  over  40000  people  died  in  Europe  and  1700000  were  injured)  with  excessive 
social  costs  (direct  measurable  cost  of  road  accidents  is  in  the  order  of  45  billion  Euro 
and  indirect  cost  is  3-4  times  higher;  annual  figure  is  16  billion,  that  is  2%  of  the  EU’s 
GNP). 

All  this  creates  a  demand  for  safety:  benefits  from  technology  are  expected  and  the 
introduction  of  Advanced  Driver  Assistance  Systems  (ADAS)  aims  at  dealing  with  such 
a  problem,  since  they  can  have  a  strong  effect  on  traffic  safety.  It  is  anyway  true  that,  in 
order  to  achieve  this  goal,  an  integrated  approach  is  necessary,  involving  new 
technologies,  infrastructure  improvements  and  increasing  co-operation  between  public 
and  private  sectors.  In  the  current  situation,  most  of  ADAS  applications  are  used  for 
comfort  functions  (e.g.  ACC,  Parking  Aid)  in  given  scenarios  (e.g.  highways).  Until 
now,  technical  limitations  and  a  lack  of  integration  of  the  actual  systems  have  prevented 
their  wide  diffusion,  since  they  still  show  high  costs  and  also  they  are  not  really  fitting 
the  user’s  needs.  Let’s  consider  the  example  of  FCW:  due  to  limitations  in  recognizing 
overheads  objects,  a  limit  in  the  maximum  range  at  which  fixed  obstacles  can  be  taken 
into  account  is  necessary  (typically,  not  more  than  50  m).  The  result  is  that  on  one  hand 
there  is  the  risk  to  have  a  very  low  acceptability  rate  by  users  due  to  too  high  number  of 
False  Alarms;  on  the  other  hand,  the  anti-collision  system  stop  supporting  drivers  just 
when  they  need  more! 

The  challenge  NOW  is  to  use  available  technologies  in  order  to  really  support  the 
drivers;  this  can  be  done  if  the  systems  are  able  to  understand  and  cope  with  their  own 
limits  involving  three  main  aspects: 

♦♦♦  on  sensors 

***  on  scenario  and  its  assessment 

♦♦♦  on  system  design 

All  this  means  that  the  system,  receiving  information  from  outside  of  the  vehicle,  the 
systems  will  be  able  to  assess  the  risk  of  an  accident  happening  and  support  the  drivers 
by  means  of  an  advanced  and  dynamic  in-car  machine-human  interaction,  able  to  let  the 
exchange  of  essential  safety  information  between  humans,  vehicles  and  vehicle- 
infrastructure 

A  conceptual  framework  on  which  this  is  based,  can  be  represented  by  the  concept  of 
Autonomic  Computing,  a  paradigm  for  the  design  of  systems  and  applications  able  to 
cope  with  strong  complex  environment  by  means  of  strategies  similar  to  those  used  by 
biological  systems.  An  example  is  given  by  an  homeostatic  system,  which  is  a  system 
able  to  react  to  the  environmental  changes  with  a  set  of  equal  and  opposite  changes,  in 
order  to  obtain  an  internal  balance. 
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Thereby,  in  other  words,  these  systems  can  pursue  their  goals  by  means  of  principles 
used  by  the  (human)  autonomous  nervous  system.  This  involves  the  computational 
systems,  but  it  can  be  enlarged  to  complex  technological  systems,  with  a  wide  range  of 
applications  in  different  fields:  automotive,  aeronautics,  healthcare,  etc. 

In  particular,  let’s  consider  the  first  one;  users  can  be  very  good  to  manage  “ordinary 
situations”,  but  what  happened  in  case  of  unknown  and  potentially  critical  situations? 
All  static  show  that  more  than  90%  of  accident  is  due  to  human  (wrong)  behaviour,  so  it 
is  clear  that  in  most  of  these  cases  drivers  have  chosen  the  incorrect  actions  to  take  (of 
different  kind  and  involving  different  steps  and  areas,  from  perception  to  execution  -> 
CACCIA).  In  this  context,  the  system  can  help  the  drivers  in  such  unknown  situations, 
showing  (at  least)  the  consequences  (sometimes  dramatic)  of  the  actions  that  a  user 
wants  to  take,  because  it  is  able  to  understand  and  anticipate  them  in  advance,  since 
very  often  when  drivers  become  aware,  it  is  too  late!  Under  this  point  of  view,  the  driver 
is  supported  and  helped  in  taking  the  most  appropriate  action,  with  the  system  able  to 
provide  the  right  information,  on  the  right  channels,  in  the  right  time,  tailored  for  the 
specific  user. 

At  the  moment,  “traditional  systems”  allow  to  satisfy  a  subset  of  these  requirements  and 
user’  s  needs  and  moreover  in  static  way:  a  snapshot  of  the  external  scenario  and  the 
assessment  of  this.  A  further  step  consist  in  being  aware  of  its  own  limitations,  so  that 
the  system  can  inform  the  driver  on  the  level  of  support  it  is  able  to  provide  in  a  given 
situation  and  specific  condition. 

Appling  the  aforementioned  concept  of  AC,  the  car  should  be  reactive,  namely  it  feels 
and  is  able  to  adapt  itself  to  environment;  in  other  words,  it  becomes  pro-active,  able  to 
perceive  the  surrounding  external  scenario  and  to  be  always  active  and  present.  These 
types  of  systems  should  be  completely  adaptive  and  dynamic,  since  they  have  to  take 
into  account  the  following  aspects: 

❖  change  of  (external)  operative  conditions 

❖  features  and  characteristics  of  the  users 

❖  variation  of  the  internal  scenario 

The  car  has  therefore  to  adopt  reflexes  in  order  to  support  the  drivers  when  needed,  with 
the  scope  to  design  a  system  which  responds  without  substituting  the  user’s  intelligence; 
in  fact,  in  the  last  years,  under  the  influence  of  “artificial  intelligence”,  we  have  been 
looking  for  an  “intelligent”  car  (but  intelligence  is  something  you  never  catch  -  see  the 
name  AICC  =>  Adaptive  Intelligent  Cruise  Control...).  Maybe  now  is  time  to  wish  a 
“responsive  car”,  able  to  really  co-operate  with  the  driver  in  dangerous  situations; 
being  aware  of  the  surrounding  environment  (safety  belt  all-around-vehicle  approach), 
of  the  driver’s  needs,  and  -  above  all  -  able  to  adopt  and  react  to  external  modifications 
of  the  environment,  the  new  systems  adopt  “reflexes”  in  order  to  help  in  avoiding  an 
accident  (supporting  the  users  when  they  can  do  it  and  informing  drivers  when  not )  or 
at  least  to  reduce  the  damages  and  consequences  of  it. 


106 


IDIS  2005 


Taylor 


31.  TAYLOR,  ROBERT:  POSITION  STATEMENT 

Since  the  1980s,  UK  Ministry  of  Defence,  and  other  government  defence  agencies,  have 
made  significant  research  investment  in  the  development  and  demonstration  of  decision 
support  systems  (DSS)  for  a  range  of  military  applications  using  artificial  intelligence 
(AI)  techniques,  in  particular  knowledge-based  systems  (KBS).  These  include 
intelligent  KBS/DSS  for  navy  surface  ship  command  and  control  (C2);  for  naval  air 
anti-surface,  anti-sub  surface,  maritime  airborne  early  warning  (AEW),  surveillance  and 
control  operations;  “pilot  assistant”  DSS  for  transport,  rotor-craft  and  fast-jet  tactical 
operations;  and  most  recently,  “operator  assistant”  DSS  for  supporting  supervisory 
control  of  multiple  uninhabited  air  vehicles  (UAVs).  The  methodologies  needed  for 
knowledge  acquisition,  modelling,  and  design  implementations  of  intelligent  DSS  are 
complex  and  expensive  to  perform,  but  reasonably  well  understood.  Also,  the  potential 
operational  benefits  of  automated  information  processing  techniques  (data/information 
fusion)  and  intelligent  DSS  operator  aids  seem  reasonably  well  appreciated,  in 
particular  as  mitigation  for  increasing  pressure  on,  and  competition  for,  scarce  technical 
manpower  skills.  However,  demonstrating  life  cycle  cost/effectiveness  remains  a 
concern  for  investment  appraisal  analysis  and  procurement  strategy.  Currently,  the  main 
issue  seems  to  be  how  to  progress  the  technology  readiness  of  DSS  further  and 
effectively  to  higher  levels  of  readiness,  sufficiently  to  provide  transitioning  from 
demonstration  prototypes  into  exploitation  in  acquisition  of  fully  operational  systems. 
Work  is  needed  on  the  development  of  practical  systems  engineering  procedures  and 
human  systems  integration  (HSI)  methods  for  delivering  cost/effective  intelligent  DSS. 
In  particular,  the  development  of  robust,  discriminating  and  reliable  metrics  are  needed 
-  both  measures  of  performance  (MOP)  and  measures  of  effectiveness  (MOE)  -  for  the 
specification,  development,  test,  evaluation,  validation  and  certification  of  intelligent 
DSS.  In  addition,  and  perhaps  surprisingly  given  the  maturity  of  human  factors 
engineering  and  human  computer  interface  (HCI)  design,  there  seems  to  be  a  lack  of 
practical  experience  and  understanding  of  system  and  user  requirements  for  effective 
and  intuitive  user  interfaces  and  interactions  with  intelligent  DSS.  With  the  current 
heavy  emphasis  on  developing  UAV  operations,  and  the  integration  of  DSS  with 
autonomous  decision  making  technologies,  the  implications  for  decision  making 
autonomy,  authority  and  human-in-the-loop  (HITL)  supervisory  control,  are  areas  of 
increasing  interest  and  concern.  Specifically,  there  seems  to  be  poor  understanding  of 
the  user  requirements  for  HCI  with  intelligent  DSS,  where  interfaces  and  interactions 
are  needed  to  preserve  and  support  the  HITL  decision  making  and  critical  appraisal 
skills  during  real-time  dynamic  adaptive  systems  control  with  safety  critical  systems. 
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32.  WATSON,  MARCUS:  CONSTRAINT  BASED  DECISION-MODELLING 
FOR  MILITARY  COMMANDER  DECISION  SUPPORT  TOOLS 

Defence  forces  around  the  world  have  used  computer  generated  forces  to  simulate 
battles  in  operation  analysis  studies  for  military  exercises.  Computer  based  wargame 
simulations  are  used  to  model  the  behaviours  of  constructive  entities  (i.e.  simulations 
for  infantry,  tanks,  truck,  aircraft  of  any  type,  etc.).  Subsequent  behaviours  such  as 
communication  between  entities,  group  assignments,  individual  roles  and 
responsibilities  in  a  platoon,  company  and  battalion  are  also  modelled.  In  most 
computer  based  wargames,  there  is  a  high  reliance  on  humans  to  act  as  command 
decision-makers.  The  reliance  on  humans  to  conduct  command  decision-making  is 
costly  in  terms  of  the  number  of  participants  required  to  conduct  each  wargame.  Many 
attempts  have  been  made  to  produce  intelligent  agents  to  replace  human  actors  in 
wargames  but  without  much  success  [1]. 

Heuristics  reasoning  algorithms  based  on  interviews  with  commanders  have  failed  when 
uncertainties  must  be  included  in  the  simulated  human  decision-making  processes. 
Attempts  to  use  computer  learning  have  worked  for  the  situations  in  which  the  agents 
are  trained  on  but  fail  when  a  new  situation  arises  because  there  is  insufficient  data  for 
the  systems  to  learn  the  complexity  of  factors  influencing  decision-making.  Rule-based 
processes  that  rely  on  normative  or  descriptive  models  of  the  domain  also  fail  the  first 
time  they  encounter  a  new  situation.  To  deal  with  unanticipated  situations  we  have 
develop  a  formative  model  of  commander  decision-making  using  cognitive  work 
analysis  (CWA). 

CWA  has  been  applied  in  various  domains  including  power  plant  control,  aviation, 
medicine  and  the  military  to  help  analysts  develop  an  in-depth  understanding  of 
complex  socio-technical  systems  [2]  [3],  In  the  military  environment  we  have  used 
CWA  to  identify  the  physical  and  organisational  constraints  limiting  commander’s 
decision-making.  The  decision-model  has  be  used  by  the  Defence  Science  and 
Technology  Organisation  to  produce  COMATS  intelligent  agents  for  wargames  that  are 
better  able  to  deal  with  unanticipated  events  than  previously  developed  intelligent 
agents  [1]  [4]  [5].  The  COMATS  intelligent  agents  can  generate  a  series  of  plans  by 
considering  the  available  courses  of  action;  taking  into  account  time  constraints, 
available  recourse,  the  enemy,  the  environment  as  well  as  the  agent’s  commander’s  goal. 
The  decision  model  allows  the  agents  to  evaluate  plans  according  to  military  principles 
and  their  ability  to  achieve  the  task.  Selection  of  a  course  of  action  is  based  upon 
identifying  which  plans  can  complete  the  task  and  best  leave  the  agent  in  a  position  to 
carry  out  future  tasks. 

One  issue  for  constraint  based  commander  decision-models  is  whether  the  constraints  of 
a  computer-based  wargame  actually  reflect  the  real  constraints  for  commanders  in 
operational  environments.  If  the  constraints  can  be  identified  in  real  environments  then 
decision-support  tools  that  reveal  constraints  may  reduce  the  time  taken  for 
commanders  to  make  decisions  and  may  lead  to  better  choices  in  the  course  of  action 
they  pursue.  The  concept  of  applying  CWA  to  identify  constraints  limiting  a 
commander’s  decision-making  is  now  being  transferred  from  simulated  environments  to 
real  military  commands.  We  are  in  the  process  of  identifying  the  constraints  for  a 
maritime  decision  support  tool  that  will  display  physical  and  organisational  constraints 
limiting  a  commander’s  successful  course  of  action. 


108 


IDIS  2005 


Watson 


32.1  References 

1 .  Watson,  M.,  &  Liu,  F.  (2003).  Knowledge  elicitation  and  decision-modelling  for 
command  agents.  Lecture  Notes  in  Artificial  Intelligence,  2774,  704-713. 

2.  Vicente,  K.  J.  (1999).  Cognitive  work  analysis:  Toward  safe,  productive,  and 
healthy  computer-based  work.  New  Jersey:  Lawrence  Erlbaum. 

3.  Sanderson,  P.  M.  &  Naikar,  N.  (2001).  Cognitive  engineering  evaluation  of 
human-system  integration  in  the  ADF’s  forthcoming  AEW&C  system  Report  B. 
Contract  report  under  Research  Agreement  with  DSTO  [SCHIL-DSTO- 
AEW&C-200 1  - 1  ] .  January. 

4.  Connell,  R.,  Lui,  F.,  Jarvis,  D.  &  Watson,  M.  (2003)  The  mapping  of  courses  of 
action  derived  from  Cognitive  Work  Analysis  to  agent  behaviours.  The  2nd 
Autonomous  Agents  and  Multiagent  Systems  conference.  Melbourne,  Australia. 
14-18  July  2003.  7p 

5.  Lui,  F.  &  Watson,  M.  (2003).  Cognitive  modelling  and  constrained  reasoning 
for  intelligent  agents.  The  8th  International  Conference  on  Information  Fusion. 
Cairns,  Australia.  8-11  July  2003.  7p, 


109 


IDIS  2005 


Woltjer 


33.  WOLTJER,  ROGIER:  SUPPORTING  CONTROL  THROUGH 
CONSTRAINT  RECOGNITION 

In  this  paper  we  discuss  the  utility  of  the  concept  of  constraint  in  the  design  of  support 
systems  for  process  control.  The  paper  draws  upon  concepts  from  the  book  on  the  1985 
NATO  ASI  meeting  on  Intelligent  Decision  Support  in  Process  Environments  and  adds 
current  Cognitive  Systems  Engineering  (CSE)  concepts.  Our  focus  is  the  roles  of  Joint 
Cognitive  Systems  and  the  recognition  of  constraints  in  process  control. 

First,  the  stance  of  Cognitive  Systems  Engineering  (CSE)  is  discussed.  Second,  the 
inadequacy  of  the  classical  option  generation  and  evaluation  paradigm  of  decision 
support  is  is  contrasted  to  the  CSE  approach  of  striving  for  joint  cognitive  systems  to 
retain  control.  Third,  the  important  concepts  of  time  and  goals  are  briefly  discussed. 
Fourth,  the  theory  of  supporting  control  through  the  recognition  of  constraints  is 
outlined.  Last,  the  concepts  discussed  are  applied  in  three  domains  where  the 
application  of  CSE  is  particularly  appropriate:  command  and  control,  driving,  and 
aviation  safety. 

33.1  Purpose  and  control 

We  take  the  stance  of  Cognitive  Systems  Engineering  (CSE).  A  cognitive  system 
(Hollnagel  &  Woods,  2005)  is  a  system  that  can  control  its  behavior  on  the  basis  of 
experience  towards  its  goals.  The  term  Joint  Cognitive  System  (JCS)  means  here  that 
control  is  accomplished  by  an  ensemble  of  cognitive  systems  and  (physical  and  social) 
artifacts  that  exhibit  goal-directed  behavior.  In  the  areas  of  interest  to  CSE,  typically 
one  or  several  persons  (controllers)  and  one  or  several  support  systems  are  part  of  a  JCS, 
which  in  a  complex  environment  is  jointly  engaged  in  some  sort  of  process  control. 

To  control  a  process  is  to  steer  the  behavior  of  the  process.  Thus,  when  considering  the 
design  of  support  systems  for  process  control,  it  is  useful  to  consider  the  theory  of 
cybernetics,  meaning  steermanship,  the  science  of  control.  According  to  cybernetics 
pioneers  Rosenblueth,  Wiener,  and  Bigelow  (1943),  purposeful  behavior  is  behavior 
that  can  be  interpreted  as  goal-directed,  on  the  basis  of  feedback  and  prediction. 
Hollnagel  &  Woods  (2005)  also  state  that  being  in  control  means  knowing  what  has 
happened  and  what  will  happen. 

33.2  Support  through  intelligent  automated  option  generation  and  evaluation 

The  term  ‘decision  making’  refers  to  a  mental  process  that  precedes  the  execution  of 
action.  The  decision  making  process  is  widely  described  as  including  the  sub-processes 
of  generation  of  options,  the  evaluation  of  the  desirability  of  these  options,  and  the 
selection  of  an  (optimal)  option  for  execution  (see  e.g.  Doherty,  1993).  Consequently, 
many  authors  have  stated  the  role  of  decision  support  systems  as  to  take  over  one  or 
several  of  these  processes  (cf.  Fischhoff,  1986;  Parasuraman,  Sheridan,  &  Wickens, 
2000). 

However,  letting  automation  do  these  tasks  often  introduces  more  problems  than  that  it 
helps  the  controller  (e.g.  Bainbridge,  1983;  Dekker  &  Woods,  1999,  2002).  Hollnagel  & 
Woods  (2005)  note  that  especially  the  intelligent  evaluation  of  alternatives,  and  choice 
of  most  appropriate  action  given  performance  conditions  (constraints),  is  difficult  for 
machines,  because  they  are  bad  at  finding  appropriate  criteria  for  evaluation.  The 
complexity  of  goals  and  existence  of  multiple  ways  to  achieve  these  goals,  treated  later 
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in  this  text,  makes  evaluation  even  more  difficult  and  dependent  on  the  specific  context. 
These  reflections  result  in  the  CSE  view  that  states:  ’’From  the  joint  cognitive  system 
perspective,  the  intelligence  in  decision  support  lies  not  in  the  machine  itself  (the  tool), 
but  in  the  tool  builder  and  in  the  tool  user.”  (Woods,  1986,  p.  173). 

33.2. 1  Supporting  JCS  to  retain  control 

The  CSE  view  on  intelligent  decision  support  for  process  control  is  highly  influenced  by 
the  principle  that  a  JCS  controls  its  behavior  to  achieve  its  goals.  Any  analysis  of  the 
performance  of  JCS  should  rely  on  directly  observable  phenomena.  The  unit  of  analysis 
is  therefore  not  decision  but  action.  Rather  than  supporting  decision  making,  CSE  aims 
to  support  actions  directed  at  retaining  control  (see  also  the  position  statement  of  Bjorn 
Johansson).  In  this  view  interaction  between  the  various  parts  of  the  JCS  has  to  be 
designed  to  enable  the  JCS  to  cope  with  complexity  and  to  handle  disturbances  on  the 
way  to  retaining  control.  This  view  recognizes  that  process  control  environments  are 
often  fundamentally  complex  and  that  oversimplifying  the  interaction  would  likely 
reduce  the  JCS’  ability  to  retain  control  (Hollnagel  &  Woods,  2005). 

33.3  Time 

Time  is  a  constraint  on  any  decision  making  process  (e.g.,  Volta,  1986).  In  process 
control,  time  constrains  both  the  evaluation  of  feedback  and  the  prediction  of  future 
behavior.  Support  for  control  must  take  the  unfolding  of  events  over  time  explicitly  into 
account  for  the  JCS  to  accurately  interpret  the  feedback  obtained,  to  make  sense  of  what 
is  going  on,  and  to  predict  what  is  going  to  happen  in  the  future. 

Another  important  aspect  is  that  process  control  often  involves  parallel  processes  with 
different  time  scales.  The  Extended  Control  Model  (ECOM)  of  cognition  also 
recognizes  time  in  that  the  model  has  multiple  parallel  layers  with  different  time  scales, 
on  a  continuum  from  compensatory  to  anticipatory  control.  It  describes  the  control 
layers  of  tracking,  regulating,  monitoring,  and  targeting  (see  Hollnagel  &  Woods,  2005). 

33.4  Goal  fulfillment 

A  goal  is  often  described  as  a  final  condition  in  which  the  behaving  system  reaches  a 
state  where  given  criteria  have  been  met.  Many  definitions  of  control  and  decision 
making  consider  only  one  goal.  This  oversimplification  neglects  some  important 
characteristics  of  goals  often  encountered  in  process  control  in  complex  environments, 
which  should  be  taken  into  account  in  the  design  of  artifacts  that  are  supposed  to 
support  goal-directed  behavior. 

(1)  As  task  analysis  methods  such  as  Goals-Means  Task  Analysis  (GMTA,  Hollnagel, 
1993)  show,  the  fulfillment  of  the  top  goal  in  complex  tasks  involves  the  achievement 
of  numerous  subgoals.  (GMTA  reveals  the  goal  of  the  task,  the  specific  subtasks  that 
need  to  be  executed  to  fulfill  the  goal,  and  the  preconditions  that  need  to  be  met  to 
accomplish  these  specific  subtasks.  The  latter  form  the  new  subgoals  in  a  recursive 
analysis  of  goals,  tasks,  and  preconditions.) 

(2)  The  characteristic  of  multiviability  (expressing  that  multiple  ways  exist  to  achieve  a 
goal,  see  Hollnagel,  1986)  seems  to  apply  to  a  wide  range  of  tasks  in  complex 
environments.  In  process  control  environments  with  many  variables  that  can  be 
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controlled,  or  when  variables  can  be  manipulated  over  a  wide  range  of  values,  the 
various  ways  of  achieving  high-level  abstract  goals  seem  pragmatically  innumerable. 

(3)  Research  on  dynamic  decision  making  (Brehmer,  1992)  illustrates  the  characteristic 
of  polytely:  that  often  not  one  but  many,  possibly  conflicting,  goals  have  to  be  satisfied 
to  some  extent.  There  may  be  priorities  given  for  these  goals,  that  make  it  easier  for 
people  to  choose  appropriate  action,  but  trade-offs  in  goal  fulfillment  can  be  difficult. 

(4)  Goals  are  sometimes  not  clearly  stated.  Especially  when  one  of  the  goals  is  to  get  as 
far  away  from  a  given  criterion  as  possible  (for  example  when  trying  to  make  profit),  it 
may  be  true  that  the  goal  (maximize  profit)  is  explicitly  stated  but  it  can  hardly  be 
described  as  having  a  well-defined  criterion  of  fulfillment.  So  not  only  deviation¬ 
counteracting,  but  also  deviation-amplifying  aspects  of  mutual  causal  processes 
(Maruyama,  1968)  have  to  be  considered. 

To  summarize  the  discussion  so  far,  our  view  is  that  the  classical  model  of  decision 
support  systems  -  generating,  evaluating,  and  selecting  alternatives  for  action  has  severe 
drawbacks.  In  the  view  of  CSE,  if  support  is  to  be  provided,  Joint  Cognitive  Systems 
should  be  supported  to  retain  control.  The  goals  of  the  JCS,  and  opportunities  for 
feedback  and  prediction  are  hereby  essential.  Support  systems  for  process  control 
should  take  into  account  that  the  process’  behavior  over  time  is  essential,  and  that  the 
goal  structure  often  is  complex  in  process  environments. 

33.5  Supporting  control  through  constraint  recognition 

In  the  many  tasks  where  the  option  generation  and  evaluation  paradigm  of  intelligent 
decision  support  systems  seems  inappropriate,  other  ways  of  supporting  the  JCS  to 
retain  control  may  be  found.  For  the  domain  of  air  traffic  control,  Dekker  &  Woods 
(1999)  mention  an  alternative  form  of  supporting  controllers:  “In  one  situation, 
controllers  suggested  that  telling  aircraft  in  general  where  not  to  go  was  an  easier  (and 
sufficient)  intervention  than  telling  each  individual  where  to  go”  (p.  94).  Similarly,  the 
approach  to  decision  support  that  we  are  currently  investigating  is  to  support  control 
through  recognition  of  constraints. 

33.5.1  Constraint 

Following  Reitman  (1964)  we  define  constraint  as  a  limit  on  goal-directed  behavior,  or 
an  opportunity  for  goal-directed  behavior,  or  both.  In  CSE  constraints  are  recognized  to 
shape  action  (Hollnagel  &  Woods,  2005).  Similarly,  the  related  disciplines  of 
cybernetics  and  systems  theory  consider  the  concept  of  constraint  to  be  of  major 
importance,  because  constraints  facilitate  control. 

In  cybernetics,  constraints  are  recognized  to  play  a  significant  role  in  process  control. 
One  of  the  most  fundamental  principles  of  control  and  regulation  in  cybernetics  is  the 
Law  of  Requisite  Variety  (Ashby,  1956).  This  law  states  that  a  controller  of  a  process 
needs  to  have  at  least  as  much  variety  (behavioral  diversity)  as  the  controlled  process. 
Constraints  in  cybernetics  are  described  as  limits  on  variety.  Constraints  can  occur  on 
both  the  variety  of  the  process  to  be  controlled  and  the  variety  of  the  controller.  This 
means  that  if  a  specific  constraint  limits  the  variety  of  a  process,  less  variety  is  required 
of  the  controller.  If  a  specific  constraint  limits  the  variety  of  the  controller,  less  variety 
of  the  process  can  be  met  when  trying  to  exercise  control.  Regarding  the  prediction  of 
future  behavior,  Ashby  notes  that  if  a  system  is  predictable,  this  implies  that  there  are 
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constraints  that  the  system  adheres  to.  Knowing  about  constraints  on  variety  makes  it 
possible  to  infer  what  the  system  will  do  next. 

Systems  theory  (e.g.  Checkland,  1981;  Leveson,  2004)  treats  systems  as  hierarchically 
organized  components.  For  control  to  emerge,  components  need  to  interact.  Loss  of 
control  results  from  a  lack  of  appropriate  constraints  on  component  interactions.  A 
system  design  must  continually  enforce  the  appropriate  constraints  to  ensure  control. 
Interactions  between  hierarchically  organized  components  form  adaptive  control  loops 
at  various  control  levels.  Information  to  enforce  constraints  is  communicated  downward 
in  the  hierarchy  of  components;  feedback  to  ensure  that  constraints  have  effectively 
been  enforced  is  communicated  upward. 

Thus,  constraints  have  both  the  role  of  limiting  behavior  and  facilitating  control.  It  is 
important  to  know  about  constraints  to  be  able  to  exercise  control  and  anticipate  when 
control  may  be  lost. 

33.5.2  Visualizing  constraints 

Woods  (1986)  emphasizes  the  importance  of  spatial  representations  when  providing 
support  to  controllers.  Visualizing  constraints  is  the  support  strategy  that  is  proposed 
here.  Ecological  Interface  Design  and  Representation  Design  (Vicente  &  Rasmussen, 
1992;  Woods,  1995)  offer  design  guidelines  concerned  with  constraint:  Decision 
support  systems  should  facilitate  discovery  of  constraints,  represent  constraints  in  a  way 
that  makes  the  possibilities  for  action  and  resolution  evident,  and  highlight  the  time- 
dependency  of  constraints. 

One  way  to  do  this  is  by  means  of  state  spaces.  State  spaces  are  often  used  in  the 
discipline  called  the  dynamical  approach  to  cognition  (Port  &  Van  Gelder,  1995). 
Dynamics  is  concerned  with  the  behavior  of  systems  over  time.  State  spaces  illustrate 
how  the  state  of  a  system  changes  over  time.  State  spaces  can  be  created  if  the  (part  of) 
system  behavior  to  be  illustrated  can  be  described  by  a  clearly  defined  set  of  variables 
that  change  over  time.  A  state  is  associated  with  a  choice  of  value  for  each  of  these 
variables.  The  collection  of  all  possible  or  relevant  states  is  called  the  state  space.  The 
behavior  of  dynamical  systems  over  time  can  thus  be  visualized  using  state  spaces. 

33.5.3  Applications  in  our  research 

We  have  conducted  research  to  illustrate  the  utility  of  the  concept  of  constraint  in 
various  kinds  of  process  control.  Three  domains  of  interest  will  be  briefly  discussed 
here.  Note  that  the  process  control  tasks  in  these  domains  differ  widely  in  organizational 
complexity  and  time  scales  involved,  enabling  a  broad  discussion  of  the  utility  of  the 
constraint  concept. 

33.5.4  Command  and  control 

We  are  currently  investigating  a  method  of  performance  analysis  and  decision  support 
through  the  recognition  of  constraints  in  distributed  collaborative  command  and  control 
(Woltjer  &  Smith,  2005).  In  the  settings  of  interest,  the  controllers  (or  decision  makers) 
that  form  the  JCS  are  typically  organized  in  a  flat  network-based  structure.  They  are 
mutually  interdependent  because  they  manage  resources  that  others  in  the  JCS  need  to 
jointly  accomplish  the  overall  goals.  Because  of  this  mutual  interdependency,  actions  of 
one  controller  have  implications  for  the  other  members  of  the  JCS.  The  actions  of  one 
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controller  form  constraints  on  the  actions  of  others.  In  this  way,  constraints  are  said  to 
propagate,  to  make  new  constraints  or  to  change  existing  constraints.  The  characteristics 
of  polytely,  multiviability,  and  existence  of  many  subgoals  apply  to  these  settings.  Our 
current  experimental  platform  is  the  C3Fire  microworld  (Granlund,  2003)  where  the 
participants  engage  in  the  task  of  fighting  forest-fires.  The  analysis  of  performance  in 
terms  of  state  spaces  and  constraints  is  currently  underway. 

33.5.5  Automobile  driving 

Automobile  driving  can  be  seen  as  a  process  control  task.  The  JCS  of  driver,  passengers, 
and  automobile,  tries  to  achieve  the  goals  of  safely  but  efficiently  steering  itself  to  a 
destination  (Hollnagel,  Nabo,  &  Lau,  2003).  Many  constraints  exist,  such  as  the 
locations  and  width  of  roads,  state  of  the  road  surface,  mechanical  properties  of  the 
engine,  brakes,  etc.  Goals  exist  on  many  time  scales:  the  JCS  needs  to  maintain  a 
particular  lateral  distance  from  road  sides,  to  navigate  a  curve  or  a  set  of  curves  in  a 
certain  way,  and  to  reach  a  final  destination,  to  mention  a  few.  Many  technical  systems 
under  development  in  industry  and  academia  are  meant  to  provide  information,  issue 
warnings,  take  control,  and/or  support  driving  in  some  other  way  (for  examples  see  Lu, 
Wevers,  &  Van  der  Heijden,  2005)  in  the  name  of  safety,  efficiency,  and  comfort. 

Some  descriptions  and  investigations  of  constraint  in  driving  can  be  found  in  literature, 
of  which  two  will  be  mentioned  here.  In  their  theoretical  field  analysis  of  automobile 
driving,  Gibson  &  Crooks  (1938)  describe  the  field  of  safe  travel,  a  field  that  can  be 
seen  as  a  field  delimited  by  the  constraints  that  the  environment  puts  on  the  safe 
movement  of  the  automobile.  A  more  recent  example  is  the  study  by  Flach,  Smith, 
Stanard,  &  Dittman  (2004)  that  demonstrates  how  braking  performance  represented  in 
an  optical  state  space  reflects  how  constraints  are  handled.  Their  state  space  represents 
(1)  distance  to  relevant  textures  (for  example  the  car  driving  in  front  of  you)  through  the 
variable  of  the  optical  angle  associated  with  the  texture,  and  (2)  closure  rate  to  that 
texture  through  the  variable  of  angular  expansion  rate.  Performance  of  the  JCS  can  thus 
be  illustrated  and  understood  better  with  the  help  of  representing  constraints  in  state 
spaces. 

In  an  experiment  of  driving  in  a  virtual  world,  we  have  investigated  the  effect  of  the 
constraint  of  road  (path)  width  on  driver  performance  (Zhai,  Accot,  &  Woltjer,  2004). 
While  holding  all  other  constraints  constant,  the  manipulated  environmental  constraint 
of  road  width  was  found  to  systematically  affect  driving  performance  in  a  task  where 
participants  were  asked  to  drive  as  fast  as  safely  possible  on  straight  and  circular  road 
segments.  Because  many  constraints  that  occur  in  natural  settings  of  driving  were  not 
present  during  the  experiment,  this  study  tells  more  about  movement  that  is  similar  to 
driving  in  a  simple  virtual  world,  than  about  driving  in  natural  settings,  but  the 
systematic  analysis  of  the  effects  of  individual  constraints  is  useful  in  understanding 
tasks  such  as  driving. 

33. 5. 6  Aviation  safety 

The  JCS  of  managers  of  airlines,  maintenance  personnel,  pilots,  governmental 
organizations  concerned  with  safe  flight,  air  traffic  controllers,  etc.  is  jointly  concerned 
with  safe  flight,  but  also  with  efficiency  of  all  processes  that  are  involved  in  the  air 
transportation  system  (Smith,  2001).  Unfortunately,  the  effects  of  competing  goals  of 
safety  and  efficiency  contribute  to  accidents,  in  which  control  of  the  processes  that 
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constitute  safe  flight  is  lost  (see,  for  example,  the  loss  of  control  of  Alaska  Airlines 
flight  261,  discussed  in  Dekker,  2004).  In  Leveson’s  (2004)  systemic  accident  model, 
which  has  its  basis  in  systems  theory,  an  accident  results  from  inadequate  enforcement 
of  constraints,  as  was  described  earlier.  An  other  new  systemic  accident  model  is 
presented  by  Hollnagel  (2004),  in  which  functional  resonance  of  impaired  or  missing 
barriers,  latent  conditions,  technological  failures,  and  human  performance  variability  is 
of  major  concern.  Barriers  are  hindrances  that  may  either  prevent  an  unwanted  event  to 
take  place,  or  protect  against  the  consequences  of  an  unwanted  event  (ibidem).  Barriers 
form  constraints  on  processes,  and  thereby  enable  control.  Constraints  seem  to  play  a 
critical  role  in  controlling  safety-critical  processes.  Knowledge  of  constraints,  violations 
of  constraints,  and  the  resulting  propagation  and  effects  of  constraints  are  also  among 
our  current  research  interests.  Possibly  the  explicit  representation  of  the  handling  of 
constraints  over  time  could  aid  controllers  and  managers  in  the  complex  world  of 
aviation  to  recognize  when  safety  goals  are  endangered. 

33.6  Conclusion 

The  literature  on  automation  illustrates  that  the  classical  model  of  decision  support 
systems  -  generating,  evaluating,  and  selecting  alternatives  for  action  has  severe 
drawbacks.  In  the  view  of  CSE,  if  support  is  to  be  provided,  Joint  Cognitive  Systems 
should  be  supported  to  retain  control.  Constraints  are  recognized  as  essential  to  enable 
control.  To  offer  support,  artifacts  could  be  designed  to  be  a  part  of  the  Joint  Cognitive 
System  that  makes  controllers  aware  of  the  existing  constraints  on  their  actions.  The 
current  direction  of  our  research  is  to  analyze  joint  system  behavior  relative  to 
constraints  and  to  investigate  the  possibilities  for  the  visualization  of  constraints  as 
support  for  process  control  tasks. 
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34.  WREATHALL,  JOHN  (CO-AUTHORED  WITH  MERRITT,  ASHLEIGH): 
THE  MESSAGE  IS  THE  MEDIUM 

When  does  the  style  of  presentation  of  safety  data  matter  to  management?  Work  on 
leading  indicators  of  human  and  organizational  performance  has  led  to  the  development 
of  measures  to  help  management  know  where  they  are  in  'safety  space'  (e.g., 
Rasmussen's  3-dimensional  graph).  However,  the  ways  in  which  this  information  is 
presented  plays  a  critical  role  in  management  being  able  to  understand  and  take  action 
on  it.  Too  often  management  is  presented  with  the  worst  kinds  of  data  display:  time 
trend  charts  from  Microsoft  Excel.  While  this  may  be  an  extremely  low-tech  issue  for  a 
high-phalutin'  conference  like  this,  it  is  perhaps  a  diverse  application  of  "intelligent 
decision  support  systems".  Like  other  support  system  designs,  it  is  of  course  important 
to  consider  what  are  the  decisions,  and  on  what  basis  are  they  made,  when  evaluating 
such  support  systems.  Our  work  has  gone  in  the  direction  of  providing  very  specific 
answers  to  very  specific  questions;  questions  that  even  the  managers  were  often 
unaware  that  they  were  asking. 

Starting  with  the  view  that  many  types  of  indicators  (especially  org.  cultural/behavior 
ones)  can  parallel  the  traditional  psychological  questionnaire/survey  paradigm,  consider 
the  following: 

•  First  designed  to  measure  cognitive  ability  (IQ  tests)  and  personality  -  both 
complex  intra-psychic  constructs  that  the  individual  cannot  clearly  articulate 
without  help 

•  Also  attitudinal  tests  that  try  to  “trick”  respondents  into  revealing  their  true  but 
negative  attitudes,  e.g.,  racism,  anti-social  behavior 

•  There  is  some  all-knowing  being,  the  analyst,  who  will  translate  the  person’s 
responses  into  truth  (academic  conceit?) 

•  Statistical  reliability  is  usually  achieved  through  multiple  items  per  construct. 
Although  tedious  for  the  respondents,  this  was  often  not  a  problem  as  subjects 
were  either  students  (getting  class  credit  for  their  time),  or  people  being  tested  in 
the  clinical  environment 

•  Each  individual  should  complete  the  questionnaire  without  knowing  what  others 
have  written  -  this  must  be  a  hangover  from  academics  (“no  cheating”) 

•  It  is  often  the  case  that  you  have  to  wait  a  long  time  after  you  complete  the  survey 
to  learn  anything  about  the  results  -  this  seems  to  add  to  the  mystique  of  the 
process. 

Problems  with  this  paradigm  when  applied  to  culture  and  other  types  of  organizational 
measures: 

•  The  methodology  for  group  surveys  is  still  premised  on  finding  the  one  truth 
(often  arrived  at  by  averaging  -  how  silly  is  that?)  but  OC  is  about  shared  meaning 
and  perceptions  -  there  isn’t  one  precise  truth  we’re  seeking. 

•  You’re  not  delving  into  the  psychic  or  trying  to  trick  the  respondent  with  indirect 
questions.  There  is  no  trick  -  whatever  a  person  thinks  about  their  org  is  their 
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truth.  This  ‘truth’  can  be  enhanced  however  with  increased  knowledge  of  the  org. 
A  person  who  knows  more  about  what  is  going  on  -  who  is  not  ignorant  about  org 
processes  -  may  have  a  more  educated/aware/informed  perception.  The  way  to  get 
better  quality  answers  is  not  to  trick  the  respondent,  or  to  ask  them  several 
questions  on  the  same  theme,  but  to  educate  them  about  the  organization  and  its 
practices,  (to  sharpen  their  perception,  bring  things  into  focus,  address  rumors, 
announce  changes) 

•  A  learning  organization  or  learning  culture  is  premised  on  all  members  in  the 
collective  sharing  their  knowledge  and  applying  their  learning.  We  want  to  tap 
into  this  sense  of  collective  sharing  and  learning 

•  Let’s  remove  a  lot  of  the  mystique  and  sense  of  “higher-up”  power  in  traditional 
surveys,  and  democratize  the  process  for  the  org  members.  This  will  help  remove 
suspicions  about  Senior  Leaders  “messing  with  the  data”  and  make  the  whole 
thing  more  transparent.  The  more  transparent,  the  more  opportunity  for  learning 
on  all  fronts 

What  can  be  done  then?  One  idea  we  have  been  working  on  (especially  Ashleigh)  is  as 
follows.  Ashleigh  got  this  idea  initially  from  Amazon  (where  you  get  to  read  other 
people’s  reviews  and  rate  them  as  useful  or  not). 

It  is  standard  to  ask  people  for  critiques  or  suggestions  for  improvement.  This  obviously 
needs  to  be  text-based  so  as  to  not  constrain  them.  However  this  list  quickly  gets 
unwieldy,  and  there  is  no  way  to  truly  discern  the  good  suggestions  from  the  chaff.  This 
task  often  falls  to  one  or  two  individuals  or  committee  -  not  much  chance  for  org-wide 
learning  here.  To  change  this 

Step  1 :  Have  categories  as  part  of  a  pull-down  menu  for  the  suggestions.  If  they  want  to 
comment  on  procedures,  they  write  in  that  box;  they  should  be  able  to  write  as  many 
suggestions  as  they  want  in  as  many  or  as  few  categories  as  they  want,  including 
multiple  suggestions  for  the  same  category.  The  person  gets  to  decide  if  they  want  their 
suggestions  to  be  anonymous.  (I  bet  if  they  think  it’s  good,  they’ll  put  their  name  to  it) 

Step  2:  These  suggestions  should  be  available  to  everyone.  A  person  should  be  able  to 
write  their  suggestions  and  then  go  in  and  rate  other  people’s  suggestions.  A  person 
might  be  curious  what  other  people  wrote  in  the  Procedures  category,  so  they  pull  down 
all  suggestion  so  far,  and  rate  them  (rating  scale  using  stars,  something  like:  this  is  a 
great  idea,  I  think  it  would  make  a  big  difference. . .  good  idea,  but  not  a  priority  .... 

This  idea  won’t  work).  The  person  can  both  rate  the  suggestion,  and  also  provide  a 
comment  if  they  wish  (a  sub-comment  if  you  will).  Just  like  Amazon,  you  could  also 
have  a  counter  of  how  many  people  read  and  rate  the  suggestion 

Step  3:  the  powers  that  be  (from  supervisors  to  dept,  heads  to  cross-disciplines  and 
senior  mgmt)  can  read  these  suggestions,  and  pay  attention  to  the  collective  wisdom  that 
will  create  a  natural  prioritization  and  selection  process.  It  would  be  a  nice  feature  if  you 
could  call  up  the  suggestions  not  only  by  category  but  also  endorsement  (e.g.,  all 
suggestions  with  a  rating  of  3  stars  or  higher). 

It  is  also  necessary  to  time  stamp  the  suggestions,  so  that  you  can  go  in  and  ask  for  the 
suggestions  added  since  the  last  time  you  looked.  This  is  a  living  document,  moving 
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forward,  so  time  stamping  will  help  keep  a  track  of  which  suggestions  are  attracting 
comments,  and  which  suggestions  do  not. 

Step  4:  When  an  action  is  taken  in  response  to  a  suggestion,  there  is  a  big  thumbs-up 
symbol  or  something  equally  flashy  and  positive  to  indicate  action  was  taken  on  the 
suggestion.  Clicking  on  the  symbol  could  link  to  the  action  details  (similar  to  a 
corrective  actions  database). 

Step  5:  there  can  be  a  periodic  cleaning  out  of  the  suggestions,  e.g.,  Could  create  a  rule 
-  no  comments  on  a  suggestion  for  3  months,  the  suggestion  goes  to  a  secondary 
database,  drop  all  suggestions  with  1  or  fewer  stars  rated  by  X  or  more  people  to  a 
secondary  database. 

Step  6:  Ask  people  to  also  rate  and  comment  on  the  actions  taken.  While  this  may 
initially  seem  like  overkill,  I  think  it  would  help  promote  collective  awareness  and  close 
the  loop  (or  extend  it  if  someone  can  see  a  new  idea  to  follow  from  the  action).  What  we 
hear  from  many  workers  is  that  they  write  up  an  event  or  make  a  suggestion  and  never 
find  out  if  anything  happened.  This  way,  they  can  go  to  their  suggestion,  see  if  it  got  a 
thumbs-up,  see  the  action  taken,  and  again  in  the  spirit  of  shared  organizational  wisdom, 
they  and  others  can  comment  on  its  effectiveness.  It’s  a  great  way  to  publicize  the 
actions  taken,  and  it  also  promotes  the  idea  that  the  organization  is  always  learning. 
Maybe  the  action  taken  wasn’t  effective,  as  rated  by  the  workers,  which  leads  to  new 
ways  of  doing  things.  Very  transparent  actions. 

A  second  approach  to  the  use  of  org  data  is  to  use  it  to  construct  stories  rather  than 
trends  and  other  crap  plots.  Stories  are  what  get  management  attention.  Therefore  when 
getting  the  cultural  data  inputs,  always  ask  for  instances  and  examples  of  what  is  being 
rated.  Thus,  when  priorities  are  being  worked  out,  the  actual  instances  feed  the  decision¬ 
makers’  process  (what  a  concept!!).  We  have  sat  through  endless  meetings  with 
management  as  they  are  faced  with  the  inevitable  pretty  plots  from  Excel.  The  honest 
managers  say  that  this  tells  them  nothing,  and  they  do  not  want  it.  It  is  only  noise.  What 
they  need  are  the  underlying  stories,  prioritized  according  to  some  sort  scheme.  Thus  an 
indicator  may  be  a  high  priority  because  more  than  50%  of  the  staff  have  rated  it  as  an 
important  or  quite  important  concern.  Indicators  tend  to  be  ‘high  level,’  like 
“communications”,  but  what  is  the  real  problem  with  communications?  The  stories  are 
the  details  of  the  problem,  without  which  managers  are  usually  shooting  in  the  dark. 
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35.  YOON,  WAN  CHUL:  KNOWLEDGE  STRUCTURES  FOR  INTELLIGENT 
DECISION  AIDS 

35.1  Intelligent  Decision  Support  and  Knowledge  Works 

The  need  of  intelligent  decision  aiding  is  almost  always  coupled  with  human  knowledge 
works.  As  human  works  becomes  more  knowledge-based  or  knowledge -bound, 
knowledge  becomes  the  key  determining  factor  in  designing  intelligent  decision  support 
systems  (IDSS).  The  important  characteristics  of  human  knowledge  in  works  that  are 
relevant  to  the  roles  and  design  principles  of  IDSS  are:  (1)  knowledge  has  a  life  cycle 
(2)  knowledge  is  organised  and  highly  relational  (3)  knowledge  is  learned,  better  in 
intuitive  ways,  and  its  use  can  be  practiced  (4)  there  is  a  personal  or  task-specific 
diversity  in  human  knowledge  and  its  use.  The  design  and  evaluation  of  an  IDSS  should 
be  based  on  these  characteristics  of  human  knowledge  and  related  human  behavior. 

35.2  Knowledge  and  the  Spectrum  of  Topics  in  IDSS 

The  spectrum  of  intelligent  decision  support  can  usefully  be  derived  from  the  life  cycle 
of  knowledge  in  human  works,  which  comprises  of  acquisition,  pre-processing,  use  in 
decision  making,  storage  and  maintenance.  Corresponding  elements  of  IDSS  for  the 
stages  are  automated  or  interactive  knowledge  acquisition  [6],  intelligent  information 
processing  to  match  the  human  strategies  [5,  7],  intelligent  interfaces  with  cognitively 
designed  information  representation  [2,  3]  or  interactive  optimisation  [1,4],  and 
knowledge  management  systems  [4],  respectively.  In  each  of  these  elements  of  IDSS, 
the  other  three  characteristics  mentioned  in  the  above  can  be  considered  to  provide  the 
directions  for  advancing  IDSS  application  as  well  as  research  topics. 

35.3  The  Cases:  Representing  Knowledge  Structures  to  Aid 

This  statement  is  focused  on  the  importance  of  considering  the  human  knowledge 
structures  for  designing  effective  IDSS's.  The  human  work  knowledge  is  highly 
structured  and  organised  with  relations,  of  which  types  include  abstraction, 
decomposition,  causalities,  and  so  on.  The  knowledge  structure  and  relations  provide 
the  keys  to  the  design  of  effective  decision  aid. 

In  a  study  to  examine  the  supporting  effectiveness  of  ecological  interface  design  [2],  we 
found  the  system  state  information  helps  the  operator  better  when  it  is  represented  at 
multiple,  related  levels  of  abstraction.  Although  the  multi-level  information  was 
displayed  without  other  aiding  features  such  as  graphics,  the  operators  seemed  to  be 
able  to  get  cues  and  explanations  from  the  displays  as  needed.  The  system  helped  by 
presenting  the  useful  relations  in  knowledge,  not  by  replacing  the  human  reasoning. 

Another  experimental  study  evaluated  a  design  decision  support  for  user  interface 
designers  [4],  The  system  was  similar  with  case-based  systems  but  unique  in  its 
presentation  of  prior  design  solutions  at  multiple  levels  of  abstraction.  Industrial 
designers  participated  in  the  experiments  and  the  results  showed  the  effectiveness  of  the 
designed  representation  which  provided  vertically  related  solutions  along  the  abstraction 
hierarchy.  As  in  the  first  mentioned  study,  this  implies  that  the  decision  support  system 
should  intuitively  present  the  structure  of  information  when  the  structure  is  to  be 
explored  by  human  strategies  for  decision  making.  Also,  both  studies  indicated  the 
importance  of  supporting  the  use  of  abstraction  relations. 
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The  knowledge  structure  may  be  very  different  depending  on  the  tasks  even  when 
describing  a  same  system.  An  example  is  the  distinct  descriptions  of  a  same  piece  of  UI 
(user  interface)  software  between  the  UI  designers  and  software  engineers.  UI  designers 
prefer  to  use  a  flow  diagram  of  user-device  interaction  for  given  tasks  to  examine  the 
convenience  and  consistency  of  the  interacting  methods.  The  software  programmers 
need  to  have  a  state  transition  diagram  that  describes  how  the  elementary  modules  need 
to  be  formed  and  controlled.  Since  the  two  expert  teams  are  working  on  the  design  of 
the  same  software,  the  gap  between  the  views  and  models  that  they  use  is  apt  to  hamper 
the  communication  and  hence  the  quality  of  implementation.  To  help  such  cases,  a 
design  decision  support  system  was  constructed  [5].  It  converted  between  the  two  types 
of  models  to  help  designers  to  verify  both  aspects  of  the  interface.  This  system,  being 
more  active  than  the  first  two,  was  shown  helpful  in  an  evaluation  where  industrial 
designers  participated. 

35.4  Conclusions 

Where  intelligence  needs  to  be  aided,  there  exists  task  complexity.  Task  complexity 
should  almost  always  be  dealt  by  heavily  organized  knowledge.  The  common 
conclusions  from  the  three  studies  are  that  the  information  should  be  represented  in  an 
intuitive  way,  and  the  intuitiveness  is  determined  by  the  way  in  which  the  human 
utilises  internal  organisations  in  the  relevant  knowledge.  At  times,  the  support  system 
should  manipulate  or  even  create  the  relations  required  to  (re)organise  the  knowledge 
into  a  fashion  that  is  intuitive  for  a  particular  task.  Since  there  are  other  structural 
aspects  of  knowledge,  such  as  schemata,  scripts,  causalities  and  correlations  that  may  be 
utilized  by  human  decision  makers,  the  same  principle  may  be  extended  to  wide  variety 
of  supporting  approaches.  Analyzing  the  knowledge  structures  and  their  use  should 
become  the  core  in  any  disciplined  design  processes  of  building  IDSS. 
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36.  APPENDIX:  INTRODUCTION  TO  THE  PROCEEDINGS  FROM  THE 
1985  MEETING 


Introduction 

The  increasing  complexity  of  technological  systems  has  shifted  the  demands  on  human 
performance  from  a  mechanical/physical  level  to  a  cognitive  level.  The  role  of  the 
human  in  complex  systems  is  to  act  as  a  supervisor  of  automated  or  semi  automated 
resources  with  goal  setting,  problem  solving,  and  decision  making  as  the  primary  tasks. 
While  the  negative  consequences  of  possible  malfunctioning  have  grown,  the  tolerances 
for  performance  variability  have  been  reduced  and  the  demands  to  accurate  and  safe 
performance  increased,  thereby  leaving  the  human  operator  in  a  very  difficult  position. 
At  the  same  time,  advances  in  computer  science  (e.g.  automated  decision  makers,  object 
oriented  programming,  and  expert  systems)  have  provided  new  possibilities  to  support 
human  performance  that  challenge  established  man-machine  system  design  principles. 

Decision-making  has  emerged  as  the  focal  point  for  the  often  conflicting  demands  to 
human  action.  To  ease  the  operator's  task  one  must  reduce  these  demands  by 
incorporating  basic  intelligence  functions  in  the  man-machine  interface.  But  it  is 
essential  that  an  intelligent  interface  supports  the  operator's  decision  making  rather  than 
replaces  parts  of  it,  i.e.  that  it  is  a  tool  rather  than  a  prosthesis  The  former  may  improve 
the  task,  while  the  latter  will  surely  aggravate  it.  The  logic  behind  decision-making  has 
been  considerably  extended  in  recent  years,  for  instance  by  fuzzy-set  theory  and 
possibility  theory.  A  clear  distinction  has  also  emerged  between  domain  specific 
knowledge  and  decision-making  strategies.  Decision  making  is  no  longer  regarded  as 
simply  the  strict  following  of  a  single  set  of  rules  or  a  strategy,  but  must  also  include  the 
selection  of  the  appropriate  rules  and  the  possible  switch  between  them  as  the  decision 
evolves,  i.e.  meta-level  decisions. 

The  aim  of  this  ASI  was  to  identify  the  knowns  and  unknowns  of  intelligent  systems 
that  can  support  human  decision-making  in  process  environments.  The  focus  was  the 
functional  rather  than  the  analytical  aspects  of  such  systems.  The  emphasis  on  and  the 
development  of  systems  that  perform  cognitive  tasks  require  a  corresponding  shift  in  the 
multiple  disciplines  that  support  effective  man-machine  systems.  It  requires 
contributions  from  decision  theory,  theoretical  and  applied;  from  philosophy  and  logic; 
from  process  control  theory  and  information  science;  from  cognitive  psychology  and  the 
study  of  human  performance  and  human  error;  and  from  artificial  intelligence  and 
computer  science.  This  was  achieved  by  describing  (1)  the  foundation  provided  by 
decision  theory,  (2)  the  problems  of  decision  making  in  process  environments,  (3)  the 
cognitive  aspects  of  decision  making,  and  (4)  the  possibilities  of  artificial  intelligence 
and  advanced  computer  applications  The  ASI  aimed  to  synthesise  and  integrate 
developments  in  all  four  areas. 

As  mentioned  in  the  preface,  this  ASI  Joined  a  series  of  other  meetings  that  all  had  dealt 
with  problems  of  man-machine  systems.  The  five  major  previous  meetings  were: 
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1976 

Monitoring  Behaviour  and  Supervisory 

Performance 

Berchtesgaden,  West 
Germany 

1977 

Theory  and  Measurement  of  Mental  Load 

Mati,  Greece 

1979 

Changes  In  Nature  and  Quality  of  Working  Life 

Thessaloniki,  Greece 

1981 

Human  Detection  and  Diagnosis  of  System  Failures 

Roskilde,  Denmark 

1983 

Human  Error 

Bellagio,  Italy 

The  present  ASI  used  the  interdisciplinary  cooperation  and  knowledge  foundation 
established  in  the  previous  conferences  to  address  the  problems  of  cognitive  man- 
machine  systems.  During  the  two  weeks  specialists  from  the  above-mentioned  fields 
worked  together  to  advance  the  synthesis  of  knowledge  needed  for  the  development  and 
evaluation  of  such  joint  cognitive  systems,  present  the  current  unsolved  problems,  and 
point  to  possible  solutions.  The  outcome  is  documented  in  this  book. 

Whereas  most  readers  of  this  book  probably  will  have  a  good  understanding  of  what 
decision  making  and  decision  support  systems  are,  it  may  be  useful  to  describe  briefly 
what  is  meant  by  process  environments  and  how  decision  making  In  process 
environments  differs  from  other  types  of  decision  making. 

Process  environments  are  first  of  all  characterised  by  having  short  time  constants.  The 
decision  maker  must  constantly  pay  attention  to  the  process  because  the  state  of  it 
changes  dynamically;  if  he  fails  to  do  so  he  will  lose  control.  If  time  was  not  that  critical 
it  would  be  possible  to  leave  the  process  and  look  for  information  in  other  places, 
consult  available  experts  and  knowledge  bases,  etc.  To  use  an  example  from  medicine, 
if  time  is  not  critical  one  is  dealing  with  a  population  phenomenon,  for  example  the 
effects  of  smoking;  if  time  is  critical  one  is  dealing  with  an  individual  phenomenon,  for 
example  toxification.  If  there  is  no  time  pressure  one  can  always  refer  to  data  from  the 
population  and  neglect  the  process  without  endangering  it. 

Formal  decision  theories  do  generally  not  contain  any  element  of  time  (cf.  the  paper  by 
Giuseppe  Volta),  hence  fail  to  recognise  an  essential  attribute  of  process  environments. 
They  are  therefore  not  directly  applicable  but  require  further  development  and 
modification. 

Another  characteristic  of  process  environments  is  the  uncertainty  about  data,  i.e.  one  is 
uncertain  about  what  the  next  datum  may  be.  There  is  less  than  complete  predictability 
of  what  evidence  will  appear,  both  on  the  level  of  individual  process  parameters  and  on 
the  level  of  the  process  as  a  whole.  The  uncertainty  does  not  only  arise  from  the 
imperfection  or  breakdown  of  single  components  as  in  normal  reliability  analysis  or 
Probabilistic  Risk  Analysis.  Far  more  important  is  the  uncertainty  of  the  evidence  that 
comes  from  the  dynamics  and  complexity  of  the  process  as  such.  This  lack  of  certainty 
is  in  conflict  with  some  of  the  main  assumptions  of  both  normative  and  descriptive 
decision  theory  and  naturally  makes  decisions  more  difficult  (cf.  the  comments  by 
George  Apostolakis). 
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Process  environments  are  further  characterised  by  being  dynamic,  by  having  multiple 
and  possibly  conflicting  goals,  and  by  having  incomplete  information.  The  latter  may 
lead  to  tradeoffs  between  the  speed  and  quality  of  the  decision.  Decision  making  in 
process  environments  normally  means  multiple  decisions  based  on  partial  information, 
with  little  chance  to  consider  all  the  alternatives  or  to  make  revisions.  It  is  thus  very 
different  from  the  orderly  world  that  is  assumed  by  conventional  decision  theories  -  and 
provided  by  most  of  the  experiments  carried  out  in  the  behavioural  sciences. 

The  presentations  and  discussions  at  the  ASI,  as  well  as  the  papers  in  this  book,  are 
organised  in  four  sections  corresponding  to  the  four  main  aspects  of  Intelligent  Decision 
Support  Systems.  These  are  decision  theory,  cognitive  engineering,  systems  engineering, 
and  artificial  intelligence.  The  development  and  application  of  Intelligent  Decision 
Support  systems  must  be  based  on  a  combination  of  these  four  aspects,  as  none  of  them 
is  sufficient  on  its  own.  Each  of  them  refers  again  to  other  scientific  disciplines  some  of 
which,  like  cybernetics,  are  related  to  several  aspects  of  Intelligent  Decision  Support. 

The  presentations  and  discussions  at  this  ASI  clearly  showed  the  insufficiency  of 
anyone  of  these  aspects  to  account  completely  for  the  functioning  of  Intelligent 
Decision  Support  Systems,  but  also  demonstrated  how  interdisciplinary  cooperation  can 
bring  about  new  ideas  and  solutions. 

Decision  theory,  whether  normative  or  descriptive,  is  a  natural  starting  point  for  this 
book.  It  provides  a  basic  understanding  of  the  theoretical  and  practical  issues  and  of  the 
currently  unresolved  problems.  Cognitive  engineering  gives  the  view  of  a  recent 
combination  of  a  number  of  disciplines  that  all  focus  on  the  cognitive  aspects  of  system 
functioning,  and  in  particular  addresses  the  relation  between  knowledge  and  decision¬ 
making.  This  view  is  closely  related  to  the  current  developments  in  systems  engineering 
which,  together  with  decision  theory,  represent  the  more  established  views.  The  section 
on  systems  engineering  summarises  and  identifies  some  of  the  shortcomings  of  a 
traditional  engineering  approach,  and  points  to  ways  in  which  they  can  be  solved. 

Finally,  the  section  on  artificial  intelligence  provides  the  experience  from  trying  to 
incorporate  intelligent  capabilities  in  artificial  systems.  Artificial  intelligence  has 
produced  a  fascinating  repertoire  of  ideas  and  tools,  which  can  be  applied  in  developing 
Intelligent  Decision  Support  systems,  and  the  influence  on  cognitive  engineering  and 
systems  engineering  is  obvious. 

We  believe  that  these  four  aspects  are  both  necessary  and  sufficient  to  give  a 
comprehensive  description  of  Intelligent  Decision  Support  systems,  to  point  out  the 
major  problems,  and  indicate  how  the  solutions  can  be  achieved.  It  is  also  our  strong 
belief  that  solutions  can  only  be  achieved  by  a  combination  of  two  or  more  of  these 
disciplines.  The  insufficiency  of  an  approach  to  Intelligent  Decision  Support  systems 
based  purely  on  either  of  them  is  demonstrated  both  in  the  papers  and  in  the  summarised 
panel  discussion.  Decision  theory  and  systems  engineering  both  focus  on  a  description 
of  the  problem  domain,  decision  making  in  process  environments.  Cognitive 
engineering  and  artificial  intelligence  provide  an  outline  as  well  as  examples  of  the 
methodological  and  functional  solutions  that  can  be  applied  on  the  problem  domain. 

This  ASI  was  an  expression  of  the  clearly  recognised  need  for  an  interdisciplinary 
cooperation,  and  we  trust  that  the  book  demonstrates  the  benefits  of  mixing  minds  and 
metaphors  as  a  foundation  for  further  advances  into  a  new  and  challenging  field 
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